What is an HTML Entity Encoder / Decoder?
Showing HTML as text — in docs, comments, code examples — requires escaping the five special characters, or the browser interprets them as markup. Unescaped user input is also the root of XSS.
Encode turns < > & " ' into entities; decode reverses any named or numeric entity back to plain text.
How to use the HTML Entity Encoder / Decoder
- Paste your text or HTML.
- Click Encode (to escape) or Decode (to unescape).
- Copy the result.
Frequently asked questions
Which characters get encoded?
The five that break HTML: & < > " and '. That is sufficient for safe text embedding.
Does decode handle numeric entities?
Yes — named (&), decimal (&) and hex (&) all decode.
Is encoding enough to prevent XSS?
For text content, yes. Attribute, URL and script contexts each need their own escaping — context matters.
Is anything uploaded?
No — both directions run locally.