HTML Encoder
Encode and decode HTML entities
About HTML Encoder
HTML Encoder escapes the five characters that HTML reads as markup: & becomes &, < becomes <, > becomes >, the double quote becomes " and the apostrophe becomes '. Use it before you put user text, a code sample, or an attribute value into a page, so that it shows as text instead of being read as tags. All other characters, accents and emoji included, are left as they are. The Decode button does the reverse for named and numeric entities, in a single pass. Both buttons are handled by this page's own script.
Example
A link with a quoted title and a comparison, escaped with Encode:
Text
<a title="Tom's">5 > 3 & 2 < 4</a>
Encode
<a title="Tom's">5 > 3 & 2 < 4</a>
How to escape text for HTML
- 1Paste the text or code sample you want to show on a web page.
- 2Click "Encode" to replace the ampersand, the angle brackets, and both kinds of quotes with entities.
- 3To undo it, paste escaped text and click "Decode".
- 4Click "Copy" and paste the escaped result into your HTML, or keep it with "Download" (the file is encoded.txt, even after a decode).
Formats and limits
- Escaped by Encode
- & < > and both quote marks, written & < > " '
- Read by Decode
- Every named entity your browser knows, plus decimal and hex numeric entities
- Passes
- One: &lt; becomes <, never <
Where your text is processed
Escaping is a plain text replacement done by this page's script, and named entities are looked up with your browser's own HTML parser, which runs no script and loads nothing. Nothing you paste leaves the page or is stored. When something fails, such as a copy the browser refuses, we get that error with the tool's name and your browser's name and version, not your text.
Frequently asked questions
Is escaping these five characters enough to make text safe in HTML?
Yes for text between tags and for attribute values inside quotes. No for an unquoted attribute, a link address (a javascript: address stays harmful once escaped), or code placed inside script or style elements: those need other escaping or validation.
Does Decode read both ' and '?
Yes. Encode writes the apostrophe as ', and Decode turns both ' and ' back into an apostrophe, so text escaped either way reads the same after decoding.
Does it encode accented letters or emoji?
No. Only the five markup characters are replaced; é, ü, or 😀 stay as they are, which suits any page saved as UTF-8. Decode still reads entities such as é or 😀 if you paste them.
Will Encode then Decode give my text back?
Yes. Decode reads each entity once, so the & written by Encode turns back into & without touching what follows it, and text that already contained entities comes back unchanged.
Tips and tricks
- ✓Escape a code sample once only: encoding it twice makes the page show &lt; instead of <.