Free HTML entity encoder and decoder. Escape <, >, & and quotes for safe HTML display, or decode named and numeric entities back into readable text.
An HTML entity encoder/decoder that escapes special characters (like <, >, &) for safe rendering in HTML, and decodes entity-riddled text back into readable characters.
This tool encodes text for safe embedding in HTML, and decodes entity-riddled text back to readable characters. HTML gives special meaning to a handful of characters: < opens a tag, & starts an entity, quotes delimit attributes. Put raw user text or code containing those characters into a page and the browser misreads it — content disappears into imaginary tags, layouts break, and in the worst case injected script runs. The fix is entity encoding: < becomes <, & becomes &, and the browser displays the characters instead of interpreting them.
Encoding here covers the five structurally dangerous characters (&, <, >, double and single quotes) plus any character outside printable ASCII, which is emitted as a numeric entity — handy when your file might travel through systems that mangle UTF-8. Decoding understands the common named entities (&, <, >, ", ', ) as well as decimal (₹) and hex (₹) numeric forms, so text copied out of HTML source, RSS feeds or scraped pages turns back into normal prose.
Everyday jobs: embedding a code snippet in a blog post so if (a < b) displays literally; putting a company name like "R&D Labs" into an HTML attribute; cleaning up an exported document where every rupee sign arrived as ₹. One caution — entity encoding output is for HTML contexts. It is not sufficient escaping for JavaScript strings, URLs or SQL; each context has its own rules (the URL encoder next door handles that case).
Free while in beta. No card, no sales call, no onboarding call you didn't ask for.
At minimum & and < in content, plus quotes inside attribute values. This encoder handles all five dangerous characters and non-ASCII text, which is always safe to over-escape.
The same character (₹) referenced by decimal vs hexadecimal code point. Both are valid; the decoder accepts both plus common named entities.
Entity-encoding untrusted text before inserting it into HTML content is a core XSS defence, but the escaping must match the context — attribute, URL and JavaScript contexts each need their own rules. Use a templating engine's auto-escaping where possible.
Yes, the decoder supports common named entities like (non-breaking space), © (copyright), as well as numeric and hex entities.
Usually, no. It's best practice to store data in its raw, unencoded form in the database, and only encode it when rendering it into an HTML template.
Business software from the team behind these free tools.
A CRM and project workspace for growing businesses.
Visit Avexora AI CRMWhatsApp Business API platform for broadcasts, chatbots and automation.
Visit AvexWAFrom a blank page to a live funnel in minutes.
Visit Avexora AI EBOSEnterprise-grade AI systems for operations and growth.
Visit Avexora AIYour business phone, answered by AI in every language, every hour.
Visit Avexora AI Voice AgentsAI-powered OMR scanning and exam management for schools.
Visit Avexora ExamOSFree URL encoder and decoder. Percent-encode text for query strings or decode %20-style URLs back to readable text — with component and full-URI modes.
Base64 Encoder / Decoder→Free base64 encoder and decoder. Convert any text to base64 or decode base64 back to text, with full Unicode support — runs entirely in your browser.
Markdown to HTML Converter→Free markdown to HTML converter. Turn headings, lists, links, bold, code blocks and quotes into clean HTML — with raw HTML safely escaped.
Regex Tester→Free regex tester. Try JavaScript regular expressions against sample text and see every match with its index and capture groups — with clear error messages.