HTML Entity Encoder / Decoder
Free HTML entity encoder and decoder. Escape reserved HTML characters or decode named and numeric entities back to plain text.
Worked example
The text <script>alert("hi")</script> encodes to
<script>alert("hi")</script> — safe to display as
literal text on a page instead of being interpreted as a tag.
Frequently asked questions
Why do I need to encode characters like < and & for HTML?
Because HTML itself uses < and > to mark tags, and & to start an entity — if you insert those characters literally into a page, a browser will try to interpret them as markup instead of displaying them as text, breaking the page or, in the case of untrusted user input, opening the door to cross-site scripting (XSS).
What is the difference between a named entity and a numeric entity?
A named entity uses a mnemonic name, like & for an ampersand or © for ©. A numeric entity references a character by its Unicode code point instead, like © (decimal) or © (hex) for the same © symbol. Named entities are easier to read; numeric entities work for any character, including ones without a defined name.
Does encoding HTML entities prevent XSS on its own?
Escaping the five reserved characters (<, >, &, ", ') before inserting untrusted text into HTML is one important layer of XSS prevention, but it's not the whole story — where you're inserting text matters too (inside an HTML attribute, inside a <script> block, and inside a URL each need different handling). Always encode untrusted input for the specific context it's being placed into.