Hypertoolbox

Web Dev Tools

HTML Entity Encoder/Decoder - Escape & < > "

Turn special characters like <, >, &, and " into HTML entities, or decode entities back to text. Built for embedding code snippets and user input safely.

When HTML entities come into play

If you drop a literal <script> tag into an article, the browser treats it as markup rather than text. To show code snippets verbatim, or to render user-submitted text safely, characters like <, >, &, and " have to become &lt;, &gt;, &amp;, and &quot;. That swap is HTML escaping.

This tool does it in one click. Encode to entities turns the special characters into their safe form, and the other direction restores entities scraped out of a page back into readable characters.

Who gets the most out of it

  • Bloggers and technical writers — posting HTML tags and code snippets safely in an article
  • Web developers — hand-writing static pages without a template engine
  • Marketers and content writers — cleaning up &amp;-laden text pasted from email or a PDF
  • QA engineers and analysts — reading entities embedded in scraped data

How to use it

  1. Paste your text or HTML into the left box.
  2. Encode to entities turns the special characters into entities on the right. Decode from entities runs the other way.
  3. Turn on "encode all non-ASCII characters to numeric entities" to convert characters beyond ASCII, including emoji and other scripts, into &#...; form. Reserve it for special purposes such as email encoding.

A note of caution

HTML escaping alone does not stop every XSS attack. Putting user input into attributes or URLs needs extra handling that fits the context. This tool is for quick body-level escaping and decoding.

Frequently asked questions

By default, <, >, &, ", and ' (single quote) are converted. Turning on the numeric-entities option extends the conversion to every character outside the ASCII range, producing &#NNNN; output.

No. Encoding and decoding happen entirely in your browser. Sensitive content stays on your device, so it is safe to work with here.

No. It handles basic escaping for text going into body content, but values placed into attributes or URLs need additional, context-specific encoding. For security-critical code, pair this with the dedicated escaping functions your language or framework provides.

Both refer to the same character. A named entity uses a name, like &amp;, while a numeric entity uses the Unicode code point, like &#38;. Named entities cover a limited set of characters, while numeric entities can express any Unicode character, which makes them more universal.

Share this page

Related tools