Paste your text, get safe HTML – or turn encoded text back to readable
This tool converts raw text into HTML-encoded form (so special characters can't break your markup) and decodes encoded strings back into plain, readable text. Paste your input above, choose Encode or Decode, and the result appears immediately.
Everything runs in your browser. Your text is never uploaded to any server, so passwords, private content, and API snippets stay completely private.
How to html encode decode in three steps
- Paste your text (or HTML) into the input box above.
- Choose Encode to escape special characters, or Decode to restore them.
- Copy the output with one click and use it wherever you need it.
Worked example
Encoding (plain text → safe HTML)
Say you want to display a code snippet inside a web page without the browser interpreting it as markup. Your raw input:
<script>alert("Hello & welcome!")</script>After encoding, every special character is replaced with an HTML entity – a short code the browser renders as a visible character instead of acting on it:
<script>alert("Hello & welcome!")</script>Paste that encoded output into your HTML and the browser shows the original angle brackets and quotes as text – not as an executable script tag.
Decoding (HTML entities → plain text)
Paste © 2024 <YourBrand> and click Decode. You get:
© 2024 <YourBrand>The five predefined HTML escape characters
HTML has five characters that must be escaped when they appear in content. Using their entity equivalents prevents the browser from treating your text as markup and is the first line of defence against XSS (cross-site scripting) – a common web security attack where malicious code is injected into a page through unescaped input.
| Character | Entity name | Numeric entity | Why escape it? |
|---|---|---|---|
| < | < | < | Opens a tag – unescaped, the browser reads it as markup |
| > | > | > | Closes a tag – same risk |
| & | & | & | Starts any entity – must be escaped to appear literally |
| " | " | " | Breaks out of a quoted HTML attribute value |
| ' | ' / ' | ' | Breaks out of a single-quoted attribute value |
The HTML specification is maintained by WHATWG. The full list of named character references is documented at html.spec.whatwg.org – Named character references.
How to do this in code
If you need to encode or decode HTML entities inside your own project, here are the idiomatic one-liners.
JavaScript (browser)
// Encode
function encodeHTML(str) {
const el = document.createElement('div');
el.appendChild(document.createTextNode(str));
return el.innerHTML;
}
// Decode
function decodeHTML(str) {
const el = document.createElement('div');
el.innerHTML = str;
return el.textContent;
}Python 3
import html
# Encode (escape)
html.escape('<script>alert("xss")</script>')
# Returns: '<script>alert("xss")</script>'
# Decode (unescape)
html.unescape('<b>Hello</b>')
# Returns: '<b>Hello</b>'PHP
<?php
// Encode
$safe = htmlspecialchars($input, ENT_QUOTES | ENT_HTML5, 'UTF-8');
// Decode
$original = htmlspecialchars_decode($safe, ENT_QUOTES | ENT_HTML5);
?>How it works under the hood
The encoder scans every character in your input. When it finds one of the five reserved characters (< > & " '), it replaces it with the matching named or numeric HTML entity. All other characters pass through unchanged.
The decoder does the reverse: it finds entity patterns like & or < and replaces them with the real character. The underlying approach follows the MDN definition of HTML entities.
When to encode, when to decode – and when neither applies
Encode when you need to
- Display user-submitted content or code snippets safely inside a web page
- Store HTML-safe strings in a database or JSON field
- Write content inside an HTML attribute (title, alt text, data attributes)
- Send HTML over XML-based APIs or RSS feeds
Decode when you need to
- Read encoded content scraped or copied from a webpage's HTML source
- Process email bodies or RSS feed text that arrived with entities intact
- Debug a string that looks like
&copy;instead of©
When this tool is NOT the right fit
- URL encoding – if you need
%20instead of a space, use a URL encoder, not an HTML entity tool. - Base64 – for encoding binary data or images. Different algorithm entirely.
- Full HTML rendering – if you want to preview Markdown turned into HTML, try the Markdown Preview – See Your Markdown as HTML Instantly.
Bottom line: if a special character is causing broken layouts, mystery symbols, or security warnings in your HTML, paste it here and fix it in seconds.