Convert special characters into safe HTML entities, or decode HTML entities back into readable text.
Characters like <, >, and & have special meaning in HTML markup. Encoding them as entities displays them as literal text instead of being interpreted as HTML syntax.
Cross-site scripting (XSS) is a security vulnerability from injected malicious HTML/JavaScript. Encoding user-supplied text as entities before display is a standard defense against this class of attack.
Yes, the decoder handles both numeric entities (') and common named entities (&, ©, ™, and more).
This tool converts special characters into their HTML entity equivalents (encoding), or converts HTML entities back into their original characters (decoding). It's essential for safely displaying text that contains characters with special meaning in HTML markup.
Certain characters — particularly <, >, and & — are reserved in HTML because they're used to define tags and entities themselves. If you want to display a literal "<" character in a webpage's text content rather than having it interpreted as the start of a tag, you need to encode it as <. HTML entities provide this escape mechanism for reserved characters, as well as a way to represent characters that might not be easily typed (like curly quotes, em dashes, or trademark symbols).
Beyond just correct rendering, encoding is a critical security practice. If a website displays user-submitted text without encoding it first, and that text happens to contain HTML or JavaScript, the browser will interpret and potentially execute it — this is the basis of cross-site scripting (XSS) attacks. Encoding special characters before inserting user-supplied content into a page is one of the most fundamental defenses against this vulnerability, ensuring that user input is always treated as plain text, never as executable markup.
All encoding and decoding happens directly in your browser — your text is never sent to a server.