HTML Entities: Encode & Decode
Escape text so it displays as text in HTML, or turn &-style entities back into readable characters.
Fast, easy and free — your answer appears as you type, and whatever you enter stays on your device.
Encode text so a browser displays it instead of interpreting it — & to &amp;, < to &lt; — or decode entity soup back into readable characters. Both directions, live, with decoding handled by the browser's own parser so every named and numeric entity works.
How to use it
- Pick the directionEncode to make text safe for HTML; decode to make escaped text readable again.
- Paste the textCode samples, scraped content, CMS exports — the result updates as you type.
- Copy or chainCopy the result, or feed it back as input for multi-layer messes.
Text that talks about markup
HTML has a bootstrapping problem: the characters that define its structure sometimes need to appear as ordinary text. A tutorial showing a <div> must stop the browser building one. Entities are the escape hatch — write the character as a name or number, and the parser renders it without acting on it. Every code example on every documentation page passes through this transformation, which is why encode mode exists.
The archaeology of decode mode
Decode traffic comes from data that has been through too many systems. Feeds escape their content; databases store the escaped form; another layer escapes it again on the way out. The result reads like &#8217; — an apostrophe wearing three coats. Because this tool decodes with the browser's own parser, it understands the full entity vocabulary — named, decimal, hex — and repeated passes peel one layer each, so even multi-encoded text unwinds cleanly. When text looks like that, resist fixing it downstream: find which system double-escapes, and use this to verify the layers while you hunt.
Everything stays on your device, offline included.
Questions people ask
Which characters need encoding in HTML?
Five do the structural work: & < > " and '. The angle brackets open tags, the ampersand opens entities, and the quotes end attribute values. Encode those five and any text can sit safely in a page; this tool encodes exactly them, leaving everything else readable.
Why does &amp; appear on web pages sometimes?
Double encoding: text was encoded twice, so the ampersand of & got encoded again. It usually happens when two systems each 'helpfully' escape. The fix is decoding one layer — paste it here in decode mode and each pass unwraps one level.
What is the difference between ' and '?
The same apostrophe, numerically and by name. The numeric form works everywhere; ' was technically absent from old HTML4, which is why careful encoders — this one included — emit ' instead. Decoding accepts both, and every other named or numbered entity, because the browser's own parser does that work.
When do I meet entities in the wild?
Displaying code snippets on a page, content pulled from feeds and APIs that arrives pre-escaped, CMS database exports, and email templates. Decode direction gets the most traffic: turning &eacute; soup from a feed back into é.
Does this protect against XSS?
Encoding output correctly is one real part of XSS defence — untrusted text rendered into HTML must be escaped exactly like this. But security escaping belongs in your framework's templating, which does it automatically and contextually. Use this tool to understand and repair text, not as a security layer.
Is my text kept?
No — both directions run on your device, nothing transmitted.