HTML Entity Encoder & Decoder

Turn <b> into <b> so it shows up as text instead of being parsed as markup — or go the other way and turn a wall of entities back into readable characters.

How to use this tool

1. Pick Encode or Decode.
2. Paste your HTML or your entity-laden text.
3. Copy the result, or hit Swap to reverse it.

What gets escaped

Encoding always replaces the five characters that can break out of HTML context:

Tick also encode non-ASCII and accented and non-Latin characters become numeric entities too (é → é). That is rarely needed on a modern UTF-8 page, but it helps when a legacy system mangles anything outside ASCII.

Tips

• Escape & first when doing this by hand, or you will double-encode the other entities into <.
• Escaping is context-dependent. Text inside an HTML element, an attribute value, a <script> block, and a URL each need different escaping. This tool covers the first two.
• Escaping user input on output is what prevents cross-site scripting. Doing it on input instead tends to corrupt your stored data.

Related tools

• URL encoder & decoder — escaping for URLs, not HTML
• Base64 encoder & decoder — a different encoding entirely
• Case converter — reshape text before publishing
• Word counter — check length once the markup is stripped

FAQ

Is my HTML uploaded?

No. Decoding uses the browser's own HTML parser locally, which is also why every HTML5 named entity is supported without shipping a huge lookup table.

Does escaping HTML make my site XSS-proof?

It is a large part of the answer but not the whole one. You also need correct escaping inside attributes, JavaScript, and URLs, plus a Content Security Policy. Use your framework's built-in escaping wherever possible — React, for instance, escapes by default.

Why does   decode to what looks like a normal space?

Because it is a non-breaking space (U+00A0). It looks identical but never wraps to a new line, and many editors treat it as a regular space when you paste it.

What is the difference between ' and '?

They produce the same apostrophe. ' is the numeric form and works in HTML4 and XML as well, so it is the safer default.

Can I use this to clean up copy-pasted content?

Yes — decoding is a quick way to fix text that has come through a CMS or email pipeline as & or similar double-encoded mush. Run it twice if the text was double-encoded.