Free HTML Entity Encoder
Encode text into HTML entities so it displays safely in web pages — or decode entities back into readable text.
Encoding turns <div> into <div> so code displays as text instead of rendering.
How to use the HTML entity encoder
- Choose a direction: encode text into entities, or decode entities back to text.
- Paste your input. Conversion happens live as you type.
- Copy the result straight into your HTML, CMS, or code editor.
What HTML entities are for
HTML treats certain characters as markup: < starts a tag, & starts an entity. To display those characters as literal text — for example when showing code samples in a blog post — you replace them with entities like < and &. Browsers render the entity as the character without interpreting it as markup. Encoding also matters for security: inserting untrusted user text into a page without encoding is how cross-site scripting (XSS) attacks happen, because a stray <script> would execute. This tool encodes the five risky ASCII characters plus any non-ASCII character as numeric entities, so output is safe to paste anywhere. Decoding reverses the process using the browser’s own parser, which handles named, decimal, and hexadecimal entities correctly.
Frequently asked questions
What is the difference between < and <?
Nothing functionally — < is the named entity and < is the numeric (decimal) entity for the same character. Named entities are easier to read; numeric ones cover every Unicode character. This tool emits named entities for the common five and numeric ones for everything else.
Will encoding break my non-English text?
No. Characters outside ASCII become numeric entities like é, which browsers render exactly as the original character. Nothing is lost in either direction.
Is decoding safe from XSS?
Decoding itself just produces text — the tool never inserts it as HTML, so nothing executes. The danger only exists if you later inject decoded text into a page without encoding it.
Is my text uploaded anywhere?
No. Encoding and decoding run entirely in your browser. Nothing leaves your device.