HTML Entity Encoder & Decoder

Escape text for safe use inside HTML, encode every non-ASCII character as a numeric entity, or decode named and numeric entities back to text.

Runs on your device

Result

Results appear here as you type.

What it does

Showing code samples in a blog post or putting user text into a template requires escaping & < > " and '. This tool does that, and it can also decode entity heavy text copied from page sources.

How to use it

  1. Pick encode, encode all non-ASCII, or decode.
  2. Paste your text.
  3. Copy the result.

Example

The example fills in realistic values and runs the tool. Select Try an example above to see it.

When it helps

  • Publishing code snippets in HTML.
  • Cleaning scraped text full of &amp;nbsp;.
  • Preparing strings for XML or email templates.

Questions

Is escaping enough to prevent XSS?

It is correct for text placed between tags and inside quoted attributes. JavaScript, URL and CSS contexts need their own encoding.

Which named entities are decoded?

The common ones (amp, lt, gt, quot, apos, nbsp, copy, reg, trade, hellip, dashes and currency signs) plus every numeric entity.

More developer tools

See all 25

People also use

Browse all 200 tools