Turn <b> into <b> so it shows up as text instead of being parsed as markup — or go the other way and turn a wall of entities back into readable characters.
How to use this tool
- Pick Encode or Decode.
- Paste your HTML or your entity-laden text.
- Copy the result, or hit Swap to reverse it.
What gets escaped
Encoding always replaces the five characters that can break out of HTML context:
| Character | Entity |
|---|---|
| & | & |
| < | < |
| > | > |
| " | " |
| ' | ' |
Tick also encode non-ASCII and accented and non-Latin characters become numeric entities too (é → é). That is rarely needed on a modern UTF-8 page, but it helps when a legacy system mangles anything outside ASCII.
Tips
- Escape
&first when doing this by hand, or you will double-encode the other entities into&lt;. - Escaping is context-dependent. Text inside an HTML element, an attribute value, a
<script>block, and a URL each need different escaping. This tool covers the first two. - Escaping user input on output is what prevents cross-site scripting. Doing it on input instead tends to corrupt your stored data.
Related tools
- URL encoder & decoder — escaping for URLs, not HTML
- Base64 encoder & decoder — a different encoding entirely
- Case converter — reshape text before publishing
- Word counter — check length once the markup is stripped
FAQ
Is my HTML uploaded?
No. Decoding uses the browser's own HTML parser locally, which is also why every HTML5 named entity is supported without shipping a huge lookup table.
Does escaping HTML make my site XSS-proof?
It is a large part of the answer but not the whole one. You also need correct escaping inside attributes, JavaScript, and URLs, plus a Content Security Policy. Use your framework's built-in escaping wherever possible — React, for instance, escapes by default.
Why does decode to what looks like a normal space?
Because it is a non-breaking space (U+00A0). It looks identical but never wraps to a new line, and many editors treat it as a regular space when you paste it.
What is the difference between ' and '?
They produce the same apostrophe. ' is the numeric form and works in HTML4 and XML as well, so it is the safer default.
Can I use this to clean up copy-pasted content?
Yes — decoding is a quick way to fix text that has come through a CMS or email pipeline as &amp; or similar double-encoded mush. Run it twice if the text was double-encoded.
More developer tools
- Base64 Encoder & DecoderEncode text to Base64 or decode Base64 back to text, right in your browser. Handles emoji and accented characters correctly, with URL-safe output.
- JWT DecoderDecode a JSON Web Token to read its header, payload, and expiry. Runs entirely in your browser — the token is never sent anywhere.
- Regex TesterTest a regular expression against sample text and see every match, capture group, and named group. Live results, no server round trip.
- URL Encoder & DecoderPercent-encode text for URLs or decode an encoded URL back to readable text. Choose component or whole-URL mode, all in your browser.