Encode and decode HTML special character entities
Built & maintained by Pappu Venkata Subbi Reddy, founder of Clacify
HTML Entity Encoder converts special characters into their safe HTML entity codes, and decodes entity codes back into readable characters. Encoding turns characters like <, >, and & into <, >, and & so they display literally in a browser instead of being interpreted as markup — essential whenever user-provided text is inserted into an HTML page and needs to render as text, not code. It also includes a quick-reference set of common entities (currency symbols, copyright and trademark marks, math symbols) you can insert with one click. Decoding reverses the process, turning entity codes back into their actual characters — useful when you've received HTML-escaped text and need to read or reuse the real content.
Encoding replaces five specific characters with their named entity equivalents: & becomes &, < becomes <, > becomes >, " becomes ", and ' becomes ' — these five are the ones that have special meaning in HTML markup, so they're the ones that must be escaped whenever user-generated or dynamic text is placed into an HTML page as literal content. Decoding takes the opposite approach: rather than maintaining a manual reverse-lookup table (which would need to handle hundreds of possible named and numeric entities), it assigns the input string to a hidden element's innerHTML and reads back its textContent — letting the browser's own, fully spec-compliant HTML parser do the decoding, which correctly handles every entity the HTML standard defines, not just the handful this tool encodes.
Failing to encode user input before inserting it into HTML is the root cause of Cross-Site Scripting (XSS), one of the most common web security vulnerabilities: if a comment field, search box, or username is rendered directly into a page without escaping < and >, an attacker can submit text like <script>stealCookies()</script> and have the browser execute it as real code instead of displaying it as text. Escaping those characters to their entity form neutralises this completely — the browser renders the literal text <script> on screen instead of creating a script tag — which is why every serious web framework escapes output by default, and why understanding what this tool does under the hood matters even if you're using a framework that handles it automatically.
HTML entities come in two equivalent forms: named (© for ©, € for €) and numeric (© for ©, using the character's Unicode code point). Named entities are easier for a human to read in raw HTML source, but only a few hundred are defined by the HTML standard; numeric entities can represent any Unicode character at all, including ones with no named form, which is why some encoders default to numeric output for maximum compatibility. This tool uses named entities for the common cases in its quick-reference palette, since they're both correct and more readable, falling back to the browser's native handling for anything the specific replace rules don't cover.
Special characters like < > & " have special meaning in HTML. If you put them directly into HTML content without encoding, the browser may interpret them as HTML tags or attribute delimiters, breaking your layout or creating XSS security vulnerabilities. Encoding them (< > &) makes them display as literal characters.
< = < (less than), > = > (greater than), & = & (ampersand), " = " (double quote), ' = ' (single quote/apostrophe), (space) = (non-breaking space), © = © (copyright), ® = ® (registered), ™ = ™ (trademark), ₹ = ₹ (Indian Rupee).