About the HTML Entity Encode/Decode

The HTML Entity Encode & Decode tool converts between literal characters and their HTML entity equivalents. Five characters have special meaning in HTML (& < > " ') and must be encoded as entities when they appear in text content. Beyond those, any Unicode character can be represented as a numeric entity (€ for the euro sign) for maximum compatibility with older systems.

HTML encoding is essential whenever you display user-generated content on a web page. If a user submits a comment containing <script>alert('xss')</script> and you insert it into your HTML without encoding, the script runs in every visitor's browser — this is the classic XSS (cross-site scripting) vulnerability. Encoding the angle brackets as < and > turns the script tag into visible text, neutralizing the attack.

The tool also handles decoding: paste text with HTML entities (from a database export, a CMS, or a scraped page) and get back the original characters. Decoding works for both named entities (& → &) and numeric entities (& → &, & → &).

How It Works

Encoding uses a series of string replacements. The ampersand is always replaced first (because the replacement strings for other characters contain ampersands, and encoding them again would double-encode). Then angle brackets, then optionally quotes. The order matters: & in the input should become &amp; only if you explicitly re-encode — which is rarely what you want.

The five standard HTML entity replacements are: & → &, < → <, > → >, " → ", ' → '. The first three are always applied; the quotes are optional because they only matter inside attribute values (and modern HTML accepts both kinds of quotes in attribute values if they are different from the surrounding delimiter).

The “encode all non-ASCII” option replaces every character above code point 127 with a numeric entity (&#[codepoint];). This is rarely necessary today (UTF-8 is universal), but it can be useful when transmitting content through legacy systems that corrupt non-ASCII bytes.

Decoding uses a clever trick: a hidden <textarea> element is created in memory, the encoded HTML is assigned to its innerHTML (which the browser parses and decodes), and the value property returns the decoded text. This handles all named and numeric entities correctly because it uses the browser's own HTML parser.

Worked Examples

Encode the default text <p>Hello & 'welcome' to "HT99"</p> without the quotes option. The output is <p>Hello & 'welcome' to "HT99"</p>. The angle brackets and ampersand are encoded; the quotes are preserved as-is. This is correct for text content where quotes have no special meaning.

Enable the quotes option and the same input produces <p>Hello & 'welcome' to "HT99"</p>. Now the quotes are also encoded, which is what you want if you are inserting this text into an HTML attribute value delimited by quotes.

For decoding, paste a string like Café & Bistro and click Decode. The output is Café & Bistro — the named entity é becomes é, and the & becomes a literal ampersand. This works for any of the 200+ named HTML entities and any numeric entity.

When to Use This Tool

Preventing XSS when displaying user-generated content (comments, reviews, form input).
Embedding code samples in HTML tutorials (encode the sample so it displays rather than executes).
Preparing content for XML documents (where the same five characters have special meaning).
Decoding text that was over-encoded by a CMS or migration tool.
Converting accented characters to numeric entities for legacy system compatibility.
Inspecting the entity encoding of text copied from a web page.
Building HTML email templates that must display code snippets safely.

Limitations & Disclaimer

This tool encodes only the five XML/HTML special characters by default; it does not perform context-specific encoding (for JavaScript strings, CSS, URL attributes) which is required for complete XSS protection — use a library like DOMPurify or OWASP Java Encoder for untrusted content. The decoding uses innerHTML on a hidden textarea, which decodes entities but does not execute scripts (safe). The named-entity decoding relies on the browser's HTML parser and may differ slightly between browsers for obscure entities. The tool does not validate that the input is well-formed HTML — it operates on raw text. See our disclaimer for full terms.

Frequently Asked Questions

What is the difference between named and numeric entities?

Named entities use a human-readable name like <code>&amp;</code> or <code>&eacute;</code>. Numeric entities use the Unicode code point: <code>&#38;</code> (decimal) or <code>&#x26;</code> (hexadecimal) for the same ampersand. Named entities are limited to about 200 common characters; numeric entities work for any Unicode character.

Should I always encode quotes?

Only if the text will appear inside an HTML attribute value delimited by the same quote character. For text content (between tags), quotes have no special meaning and do not need encoding. Modern best practice is to use the appropriate quote type for your attribute delimiter: if your attribute uses double quotes, encode double quotes; if it uses single quotes, encode single quotes.

Does encoding prevent all XSS attacks?

Encoding the five special characters prevents the most common XSS attacks, but not all. Context-specific encoding is needed for JavaScript strings, URL attributes, CSS contexts, and so on. Use a library like DOMPurify for untrusted HTML input, and use framework features (React's JSX, Vue's mustache) that auto-encode by default.

What is the difference between HTML and XML encoding?

The five characters <code>& < > " '</code> have special meaning in both HTML and XML, and encoding them is identical. XML does not have named entities beyond these five (plus <code>&apos;</code> for apostrophe); it requires numeric entities for everything else. HTML has 200+ named entities for common symbols.

Why does decoding use a textarea element?

The <code><textarea></code> element's <code>innerHTML</code> is parsed by the browser as HTML, which decodes entities, but the <code>value</code> property returns the text content rather than HTML markup. This is a reliable way to decode entities using the browser's own parser without needing to maintain a lookup table of named entities.

Is my text uploaded anywhere?

No. Encoding and decoding happen entirely in your browser using JavaScript. Your content — including any sensitive text — never leaves your device.

Last updated: July 21, 2026 · Author: HT99 Tools Editorial Team · Reviewed by: HT99 Tools Editorial Team