HTML Encoder – Turn raw markup into safe HTML entities, or reverse an encoded string back into readable text. Everything runs in your browser — nothing is uploaded, logged, or stored.
Encode or decode your text
Bar chart: input length vs. characters escaped vs. output length.
Shortcuts: Ctrl/Cmd + Shift + I copy input; Ctrl/Cmd + R copy result; Ctrl/Cmd + Enter swap.
| Character | Named entity | Numeric | Meaning |
|---|
| Input | Mode | Exact output |
|---|---|---|
<p>Hello & welcome</p> | Encode | <p>Hello & welcome</p> |
<h1>News</h1> | Decode | <h1>News</h1> |
Café 😀 | Decode | Café 😀 |
Table of Contents
What does an HTML encoder do?
An HTML encoder will convert a text that is susceptible to being interpreted as a markup into entities, so that a browser will interpret the dangerous characters as normal letters instead of instructions. The ampersand is changed to &, the less-than sign is changed to <, and the double quote is changed to ". The page appears the same as the original to anyone who is not a member of the community. The difference to the browser is hugely different – an escaped string is data, whereas an unescaped string is a tag, an attribute, or a script block.
This is the purpose of this tool. It’s a narrow-minded converter for when you have a piece of markup, a code sample, a user comment, a template variable, a log line, and need it to be interpreted neither as you traverse an HTML document nor as you read it. Encoding is not obfuscation and not encryption, it’s just a syntax change, anyone can reverse it in a second.
How to use the HTML encoder:
Type it in the box, and the output is shown, character by character, as you type. Select Encode to get rid of special characters, or Decode to decode a string that has already been encoded into readable text. You can use named entities (like ), decimal numeric entities (like ’), and hexadecimal entities (like ’) in decode mode. When the result is correct, the field will have a 1-click copy option, or it will be pushed back into the input field to chain conversions. The stat panel and bar chart display the amount the string expanded, making it easy to know if you got away more than you planned.
Two optional switches that make a difference in appearance. Text nodes do not need to be escaped with ‘ but if the value occurs within a single-quoted attribute, then it must be escaped, otherwise the ‘ will terminate the attribute. While in most modern UTF8 pages it surely isn’t necessary, it can be a lifesaver when the recipient system does not handle multi-byte characters correctly, such as an email template, a legacy CMS field or a database column of the wrong collation.
When you ask for an HTML encoder
- Creating tutorials and documentation. If a sample of code contains tags, this sample must be escaped prior to being displayed as text.
- Displaying user-generated content. Any comments, reviews and profile bios should be encoded once they are outputted and a stray tag shouldn’t change the page around them.
- Building email templates. An explicit entity is a much more reliable traveler than a raw symbol in email clients.
- Building XML, RSS and sitemaps. XML will not accept a standalone ampersand, so feeds will fail until it’s escaped.
- Debugging double-encoded text. If a page is displaying & and there should be an ampersand, decode once to check and again to get to the original.
Named entities, numeric entities
Both can be used anywhere. In a template named entities are easier for humans to read, making review and diffs easier. Automatic encoding of numeric entities is easier to predict: unambiguous, does not rely on the browser’s ability to recognize the name, and all characters in Unicode have a numeric entity.
HTML Encoding is NOT URL Encoding or escaping!
These three things are constantly mixed up, and the mix-up creates actual bugs. HTML encoding is used to encode characters that are meaningful to the HTML parser, and the output should be in a document. Percent encoding, which is also known as URL encoding, is used to encode the characters that are significant to the URL parser: spaces are encoded as %20, & is encoded as %26. Percent encoding output is used in a query string or in a path. The backslash before a quote in JavaScript and PHP is an escaping in a programming language and should be included in source code. If you’re using the wrong one, the string will be perfectly lookalike until it encounters the parser that is not.
Real-life tips from everyday use
- You don’t escape while putting the items into storage, you escape when they are coming out of storage. Encoding on input increases the difficulty of searching and sorting, and is not suitable for protecting a second output context.
- NEVER get out twice! The most frequently cited CSS support queue complaint is double encoded text, which is always fixed by the one-time decode.
- The entities start with &, so they need to be escaped first or you create entities you break.
- Do not exit inside of <script> or <style>. The blocks are not processed as entities, as such, and escaping does not protect the code but rather breaks it.
- Keep in mind that is not a space, but a non-breaking space, and will not break at line end or will flow into narrow columns.
- Encoding is not a security measure, it is a formatting measure. Sanitise untrusted HTML using a library designed for sanitising HTML; encode untrusted plain text — don’t use encode as an alternative to input validation.
Related Tools
FAQ
What is HTML Encoding?
It is the process of converting characters that carry special meaning in HTML (mainly &, <, > and the quote characters) into their HTML entity code, so that they are interpreted as text, not HTML code, by the browser.
What characters do I want to encode?
Always use the ampersand and angle brackets! Use quotes for values that are contained within a value or attribute. Everything else is optional on a UTF-8 page, but encoding accents and symbols is useful if the receiving system is confused about how to handle accents and symbols.
Are HTML encoding and URL encoding the same?
Note that HTML encoding is for entities like <, which should be included in a document, and URL encoding is for percent codes like %, which should be used in a web address. If it’s used incorrectly, it causes the text to appear broken in the browser.
Is it possible to protect from cross site scripting by encoding?
It mitigates the risk for the particular case of inserting untrusted text into an HTML text node, or HTML attribute, but it isn’t an absolute safeguard. Any untrusted markup should be sanitized using a maintained library and a content security policy should be used in conjunction with that.
So, why is my text coming up as “&” instead of an ampersand?
The string was encoded twice – typically due to one escape on input, another escape on output. Decode, (or double decode if you want the original character) to get it back into a single level of encoding.
Reviewed by: aFreeTools Editorial Team
Last updated: September 18, 2026
Freshness: Tested against real edge cases — empty input, mixed entity forms, malformed strings
Disclaimer – This HTML encoder is provided for convenience and general reference. It performs a mechanical character-for-character conversion and is not a security tool. Do not rely on it alone to sanitise untrusted content — always validate and sanitise on the server. The authors accept no liability for any loss arising from use of this tool.
