HTML Encode / Decode
Encode or decode HTML entities.
Use on any page (bookmarklet)
Want HTML Encode / Decode without leaving the page you're on? Drag the button below to your bookmarks bar, then click it on any website to open HTML Encode / Decode right there — it runs entirely in your browser.
Use responsibly: a bookmarklet runs on whatever page you click it on. Avoid sensitive sites such as online banking, payment, or healthcare pages — you run it at your own risk. Everything is processed locally and no data is sent anywhere. See our Terms.
- Show your bookmarks bar if it's hidden — Ctrl+Shift+B (⌘+Shift+B on Mac).
- Drag the button above onto the bookmarks bar.
- Open any website and click the bookmark — the HTML Encode / Decode panel appears in the top-right corner. Use ✛ to move it between corners, or ›/‹ to tuck it against the edge and pull it back out.
- Click the bookmark again (or the ✕) to close it.
Note: a few sites with strict security policies may block bookmarklets.
Examples
Encode special characters
Input
<p>Tom & Jerry</p>
Output
<p>Tom & Jerry</p>
Decode entities
Input
café — 5 < 10
Output
café — 5 < 10
About this tool
This free online HTML encoder and decoder converts text to and from HTML entities. Encode to safely show <, >, and & on a web page, or decode entity-laden HTML back into readable text. An optional mode encodes every non-ASCII character as a numeric entity. Everything runs in your browser with no upload.
How to use
- Choose Encode or Decode.
- Paste your text or HTML (or click Sample to try it).
- Optionally turn on All non-ASCII when encoding.
- Copy the result, or use Swap to feed it back through the other direction.
Only five characters really need escaping
In HTML body text, just two are strictly required: < because it opens a tag, and & because it opens an entity. Inside an attribute value you also need whichever quote character delimits it. The > is escaped by convention rather than necessity, giving the familiar set of five: & < > " and '. Escaping beyond those is harmless but makes source markup considerably harder to read.
Escaping is context-dependent — and that's a security matter
HTML escaping is correct for text between tags. It is not sufficient everywhere else, and treating it as a universal safety measure is how injection bugs survive review. A value placed inside a <script> block needs JavaScript escaping; one placed in an href needs URL escaping and a protocol check, since javascript: passes HTML escaping untouched; one placed in a CSS rule needs CSS escaping.
For that reason, use your framework's context-aware output encoding in application code rather than escaping by hand. This tool is for inspecting, converting, and preparing text — not for securing an application.
Named, decimal, and hexadecimal
The same character can be written three ways: &, &, and & are all an ampersand. Named entities are the most readable but only exist for a defined list, so anything outside it must use a numeric form. Numeric references work for every character in Unicode, which makes them the safe choice when a system demands ASCII-only output. Decoding here accepts all three forms.
Double-escaping and mojibake
Seeing &lt; in a page means the text was escaped twice — usually because a framework escaped output that was already escaped when stored. The fix belongs in the pipeline rather than the data: escape once, at the point of rendering. Garbled sequences like ’ where an apostrophe should be are a different fault entirely, caused by UTF-8 bytes being read as a single-byte encoding. The Unicode converter will show you which code points are actually present.
Common uses
Displaying code examples inside articles without the browser executing them, preparing user-supplied text for safe rendering, diagnosing mojibake from scraped HTML, and producing ASCII-only output for systems that require it.
Frequently asked questions
What are HTML entities?
HTML entities are codes like &, <, and © that represent characters which would otherwise have special meaning in HTML or can't be typed directly. Encoding turns characters into entities; decoding turns them back.
Does encoding HTML protect me from XSS?
Escaping is a necessary part of the defence but not the whole of it, and where you insert the value decides which escaping is correct. HTML-escaping is right for text between tags. Inside an attribute you also need the quotes handled; inside a <script> block, a URL, or a CSS rule, HTML escaping is the wrong tool entirely and can still leave an injection open. Use your framework's context-aware output encoding rather than escaping by hand — this tool is for inspecting and converting text, not for securing an application.
Which five characters actually need escaping?
In HTML body text, only < and & strictly must be escaped — < starts a tag and & starts an entity. Inside attribute values you also need the quote character in use, " or '. The > is conventionally escaped as well for symmetry, though it is not strictly required. That gives the familiar set of five: & < > " and '. Escaping beyond those is harmless but makes the source far harder to read.
Which characters does it escape?
By default it escapes the five characters that matter for safe HTML: & < > " and '. Turn on 'All non-ASCII' to also encode accented letters, symbols, and emoji as numeric entities.
Does it decode named and numeric entities?
Yes. Decoding handles numeric entities like   and   plus common named entities such as , ©, —, and €.
Is my text uploaded anywhere?
No. Encoding and decoding run entirely in your browser with no upload, so your content never leaves your device.
Why would I encode HTML?
To safely display code snippets or user input on a web page without breaking the markup or opening an XSS hole — escaping & < > prevents the browser from treating your text as tags.
Learn more
Character Encoding: Unicode and UTF-8 Explained
ReferenceHTML Entities Reference: Symbols, Arrows & Special Characters
ReferenceASCII Table: Decimal, Hex, and Character Reference
ReferenceMarkdown Syntax Cheat Sheet
ReferenceHTML Tags Reference: Every Common Element by Category
ReferenceEscape Sequences Reference: \n, \t, \\ and String Escapes
Related tools