🏷️ HTML Entity Encoder & Decoder
Safely show code snippets in HTML, or turn "-riddled text back into readable characters.
How to use the HTML Entity Encoder & Decoder tool
- Choose Encode or Decode and paste your text.
- For encoding, pick special characters only or all non-ASCII, and named/decimal/hex style.
- Copy or download the result.
Frequently asked questions
Which characters must be escaped in HTML?
In text content, & and < are required; > is escaped for safety. Inside attribute values also escape " (or ' if you use single quotes). "Special chars only" handles all five.
When should I encode all non-ASCII characters?
Only when the page or email may be served without a UTF-8 charset, e.g. legacy systems or some email clients. Modern pages with <meta charset="utf-8"> can use é and emoji directly.
Does encoding protect against XSS?
Escaping untrusted text before inserting it into HTML body content is a key defence, but it is not enough inside <script>, style, URLs or event-handler attributes – those need context-specific encoding. Use your framework's templating whenever possible.
Does the decoder know every named entity?
Yes. Decoding uses the browser's built-in HTML5 table of over 2,000 named references, plus decimal (é) and hex (é) forms.