HTML Entity Encoder / Decoder
Encode or decode HTML entities, whichever the text needs.
What you paste
Parsed in your browser — never uploadedHow this reads your output
The direction is chosen from what you paste, so entity-encoded text is decoded and plain text is encoded. Encoding uses named entities where a common one exists and numeric references otherwise, which is the safest combination for systems that mangle non-ASCII text. Decoding handles named entities alongside both decimal and hexadecimal numeric references.
What the results mean
- Mode
- Encode or decode, detected from the input. Text already containing entity references is decoded.
- Named against numeric
- Named entities are readable, numeric ones work everywhere. Only five characters strictly need escaping in HTML.
- Characters affected
- How much of the input changed. If encoding changed nothing, the text was already safe as written.
Common problems and fixes
- Text is showing as & on the page
- It has been escaped twice, which happens when already-escaped text is escaped again by a template that assumes it is raw. Escape at the point of output only, never when storing, and let your templating layer do it. Almost every modern template engine escapes by default, which is why manual escaping usually causes this.
- Accented characters appear as question marks or boxes
- That is a character encoding problem rather than an entity problem, and encoding to numeric references only hides it. Check the page declares UTF-8 in a meta charset tag and that the server sends a matching content type header. Fix that and the characters can stay as themselves.
Frequently asked questions
Which characters must be escaped in HTML?
The ampersand and both angle brackets always, plus quotation marks inside attribute values. Everything else is optional on a page correctly declared as UTF-8, and escaping more than necessary makes the source harder to read for no gain.
Are named entities better than numeric ones?
They are more readable and there is no functional difference. Numeric references have the advantage of working for any character without needing to know its name, which is why they are the safer default for anything generated automatically.
Does escaping prevent cross-site scripting?
Correct contextual escaping at output time is a large part of it, but context matters enormously. Escaping for HTML text is not the same as escaping for an attribute, a URL, or inside a script block, and applying the wrong one leaves the hole open. Use your framework escaping rather than doing it by hand.
Put this on your own site
Free to embed, no attribution required beyond the source link the frame carries itself. It runs entirely in your visitor's browser, sets no cookies and loads no third-party script.
<iframe src="https://runthetests.com/embed/html-entity-encoder/" width="100%" height="720" style="border:1px solid #e5e5e5;border-radius:8px" title="HTML Entity Encoder / Decoder" loading="lazy"></iframe>
Preview it at https://runthetests.com/embed/html-entity-encoder/. Embedded pages are marked noindex, so yours stays the canonical copy — not this one.