HTML Entity Encoder/Decoder
Convert reserved characters like & < > " ' into safe HTML entities, or decode a string full of &, <, {, and { style entities back into readable text. Supports the full common HTML4/5 named entity set plus decimal and hexadecimal numeric entities, with an optional mode to escape every non-ASCII character as a numeric entity for maximum compatibility. Runs entirely in your browser.
Reviewed by Vincenzo Manto, Founder & Lead Developer · Last updated September 27, 2026
How it works
- 1
Choose Encode to turn plain text into safe HTML, or Decode to turn HTML entities back into readable text.
- 2
Paste or type your text into the input box.
- 3
For encoding, optionally enable the 'encode all non-ASCII' toggle to escape every non-ASCII character as a numeric entity.
- 4
Copy or download the result, it updates as you type.
Why HTML entity encoding matters
Characters like < and & have special meaning in HTML. If you insert user-generated text directly into a page without encoding them, a browser may interpret it as markup instead of literal text, which can break your layout or open the door to cross-site scripting (XSS). Encoding text to HTML entities before embedding it in a page is a basic safety and correctness step for anyone working with dynamic HTML.
Named vs. numeric entities
HTML supports both named entities (like & or ©, easier for humans to read in source code) and numeric entities (like & or &, which work for any Unicode codepoint even without a dedicated name). This tool handles both directions and both entity styles, so you can decode content copied from CMS exports, RSS feeds, or legacy systems regardless of which style they used.
Frequently asked questions
Which characters get encoded by default?
The five reserved HTML characters, & (ampersand), < (less than), > (greater than), " (double quote), and ' (apostrophe), are always converted to their named entities (&, <, >, ", ').
What is the 'encode all non-ASCII' option for?
When enabled, every character outside the standard ASCII range (accented letters, emoji, symbols, CJK characters, etc.) is converted to a numeric entity like é or 😀. This is useful when you need output that is guaranteed to survive systems with limited character-set support.
Which named entities can the decoder recognize?
The decoder recognizes dozens of common HTML4/5 named entities, including amp, lt, gt, quot, apos, nbsp, copy, reg, trade, ndash, mdash, euro, and many Greek letters and arrows, plus any decimal ({) or hexadecimal ({) numeric entity.
Does it decode numeric entities for emoji and other astral characters?
Yes. Numeric entities above the Basic Multilingual Plane, such as 😀 for 😀, are decoded correctly into the full Unicode character.
What happens if I try to decode something that isn't a real entity?
Unrecognized entity-like sequences (for example a typo like ¬arealentity;) are left exactly as they are instead of being silently deleted or corrupted.
Is any of my text sent to a server?
No. All encoding and decoding happens in your browser using plain JavaScript, so nothing you type is uploaded or transmitted anywhere.