HTML Entity Encoder / Decoder
Free online HTML entity encoder and decoder: named, decimal and hex forms, both ways — show code safely, fight XSS.
Privacy: all processing happens locally in your browser. Your input never leaves your device.
What is HTML Entity Encoder / Decoder?
Printing < > & " directly in HTML gets parsed as tags or breaks the page — displaying code snippets correctly and preventing XSS injection both require escaping to HTML entities first. This tool converts named entities (<), decimal (<) and hexadecimal (<) forms in both directions.
How to Use
- Paste text with special characters or an entity string
- Choose escape or unescape
- Copy the result
FAQ
- Which characters must be escaped?
- At minimum < and & in HTML body text, plus quotes inside attribute values. This tool escapes the five characters & < > " ' by default.
- Does escaping fully prevent XSS?
- HTML entity escaping only covers body/attribute contexts; URL parameters and JavaScript contexts need their own encoding strategies — there is no one-size-fits-all.
Related Tools
Base64 Encoder / DecoderFree online Base64 encoder and decoder built on UTF-8 bytes — non-Latin text and emoji round-trip cleanly, all local.URL Encoder / DecoderFree online URL encoder and decoder following RFC3986 percent-encoding, with clear errors for truncated % sequences.Unicode Escape ConverterFree online Unicode escape converter: text to \uXXXX and back, with correct UTF-16 surrogate pairs for emoji.UTF-8 / Hex ConverterFree online UTF-8 to Hex converter: text to hex bytes (中 -> e4 b8 ad) and back, with byte validity checks — local.
Last updated 2026-09-04