HTML entity encoding replaces characters that have a special meaning in HTML, such as the angle brackets and ampersand, with safe codes so a browser shows them as text instead of treating them as markup. The tool below encodes and decodes those entities entirely in your browser, so you can paste code into a page without breaking the layout or reverse encoded text back to its readable form.
What HTML Entity Encoding Is
HTML uses a small set of characters as control symbols. The less-than and greater-than signs mark the start and end of a tag, the ampersand begins an entity reference, and quotation marks wrap attribute values. When you want one of those characters to appear as ordinary text on the page, you cannot type it directly, because the browser would read it as part of the markup. Entity encoding solves this by swapping each reserved character for a named or numeric code that the browser knows to display as the original character. Decoding is the inverse: it takes the codes and restores the characters they stand for.
How to Use It
- Pick a direction. Choose Encode to convert text into HTML entities, or Decode to convert entities back into text.
- Paste your input into the box. For encoding, paste the raw text or code you want to show. For decoding, paste content that already contains entities.
- Read the result in the output box, which updates as you type.
- Copy the output and paste it into your page, template, or document.
- Switch direction at any time to check that your encoded output decodes back to the original.
How It Works
Encoding walks through your text and replaces each reserved character with its entity. The ampersand is always replaced first, because every other entity itself starts with an ampersand, and handling it last would double-encode the new codes. These five replacements cover the characters that can break HTML structure or attribute values.
| Character | Name | Entity code |
|---|---|---|
| & | Ampersand | & |
| < | Less-than sign | < |
| > | Greater-than sign | > |
| “ | Double quotation mark | " |
| ‘ | Apostrophe | ' |
When to Use It
The most common reason to encode is to show code on a web page. If you want a paragraph to display a snippet such as a tag or a sample attribute, you encode the angle brackets and quotes so the browser prints them instead of rendering them. The second common reason is safety. When a page inserts text that a user typed, encoding the reserved characters first prevents that input from being read as markup or script, which is the core defense against cross-site scripting, often shortened to XSS. On the other side, decoding is useful when you receive content that already contains entity codes and you want the plain, readable characters back, for example when copying text out of an HTML source or a feed.
Because this tool encodes and decodes locally in your browser, the text you paste never leaves your device. Nothing is uploaded, logged, or stored, so it is safe to use with private snippets and on shared networks.
Last Thoughts on HTML Entity Encoding
HTML entity encoding is one of those small mechanics that quietly keeps the web working. Without it, you could not print a less-than sign in a sentence, show a code sample, or safely echo back something a visitor typed. Knowing which five characters are reserved, and that the ampersand must be handled first, is enough to encode and decode by hand, but a tool removes the chance of a slip.
Encode before you display untrusted text, decode when you need the readable form back, and remember that this is about correct rendering, not security. For related conversions, try our URL encoder and decoder, the Base64 encoder and decoder, and the JSON formatter, or browse the rest of our free online tools.
Key Takeaways:
- Entity encoding replaces the reserved characters & < > " and the apostrophe with codes so a browser shows them as text.
- Always encode the ampersand first, since every other entity begins with one.
- Encode to display code on a page or to neutralize user input that could become markup or script.
- Decode to turn entity codes back into the plain characters they represent.
- Encoding is a display format, not encryption; it hides nothing and adds no secrecy.
- This tool runs entirely in your browser, so the text you paste is never sent anywhere.
Frequently Asked Questions (FAQs)
What is HTML entity encoding?
It is the process of replacing characters that have a special meaning in HTML, such as the angle brackets, ampersand, and quotation marks, with safe codes called entities. The browser then displays the original character as text instead of treating it as part of the markup.
Which characters need to be encoded in HTML?
The five reserved characters are the ampersand, the less-than sign, the greater-than sign, the double quotation mark, and the apostrophe. Encoding these covers the cases that can break page structure or attribute values. The ampersand is always encoded first because every entity starts with one.
Is HTML encoding the same as encryption?
No. Encoding is only a display format. The codes are public and can be decoded instantly by anyone, so encoding provides no secrecy and no protection for the data itself. Its purpose is correct rendering, not security.
How does encoding help prevent XSS?
When a page inserts text that a user typed, encoding the reserved characters first means the browser reads that text as plain characters rather than as tags or script. This stops injected markup from running, which is the core defense against cross-site scripting.
Does this tool send my text to a server?
No. Both encoding and decoding happen entirely inside your browser using built-in functions. The text you paste is never uploaded, logged, or stored, so it is safe to use with private content and on shared networks.
How do I decode HTML entities back to text?
Switch the direction to Decode and paste content that contains entity codes. The tool converts codes such as the ones for the angle brackets and ampersand back into the characters they represent and shows the readable result as you type.
