HTML Entity Encoder / Decoder — Escape and Unescape HTML

What is an HTML Entity Encoder?

An HTML Entity Encoder / Decoder (HTML एनकोडर / डिकोडर) converts characters that have special meaning in HTML into safe codes called entities, and converts those codes back into characters. In HTML, a less-than sign starts a tag, an ampersand starts an entity and quotes delimit attribute values. If you want a web page to display “<div>”, “5 < 10” or “Tom & Jerry”, those characters must be written as <, > and &. Otherwise the browser treats them as markup — breaking the layout or, with untrusted input, opening the door to cross-site scripting (XSS).

This free tool escapes the five HTML-special characters, can also convert common symbols to named entities such as © and —, or turn every non-ASCII character — Hindi, emoji, ₹ — into numeric references for systems that only accept plain ASCII. In the other direction, it decodes any named or numeric entity, from   to 😀, back into the real character. Decoding uses the browser's parse-only DOMParser, so even pasted script tags are never executed.

Key Features

• Special characters only — & < > " ' escaped for safe HTML content and attributes.
• Named entities — about 30 common symbols (&nbsp; &copy; &reg; &euro; &rarr; &hellip; …).
• Decimal references — every non-ASCII character as &#NNNN;.
• Hex references — every non-ASCII character as &#xHHHH;.
• Decode anything — all HTML5 named entities and numeric references.
• Emoji-safe — characters outside the Basic Multilingual Plane become one reference, not two.
• Entity count and one-click copy.
• Private — runs locally.

How to Use It — Step by Step

1. Choose Encode or Decode.
2. For encoding, pick a mode — special characters only (most common), named entities, or numeric.
3. Paste your text, code or HTML.
4. Copy the result, or press Use result as input to reverse it.

Encoding Modes Compared

Input: <p class="note">Price: ₹500 — "Tom & Jerry" © 2026</p>

The rupee sign has no named entity, so named mode leaves it as ₹ while the numeric modes convert it.

The Five Characters You Must Escape

HTML Escaping and XSS

Cross-site scripting happens when untrusted text — a username, comment or search term — is placed into a page without escaping, letting an attacker inject <script> or event-handler attributes. Escaping the five special characters neutralises this for normal element content and quoted attribute values, because the browser then sees text, not code. But context matters: data placed inside JavaScript, URLs, CSS or unquoted attributes needs different escaping, and some sinks (like innerHTML with user input) are risky regardless. In real applications, rely on your framework's automatic escaping (React, Angular, Django, Laravel Blade, Jinja and others escape by default), use textContent instead of innerHTML in plain JavaScript, and add a Content Security Policy. This tool is ideal for one-off escaping, documentation and learning.

Numeric Character References

Every Unicode character has a number called a code point. HTML lets you write any character as &# + decimal number + ; or &#x + hexadecimal number + ;. The Devanagari letter न is U+0928, so it can be written as न or न; “नमस्ते” becomes नमस्ते. Emoji have code points above U+FFFF — 😀 is U+1F600, written 😀 or 😀. Some naive converters split such characters into two invalid “surrogate” references; this tool reads full code points, so the output is always valid.

When Do You Actually Need Entities?

• Always for & < > and quotes when they must appear as text.
• Showing code in tutorials, blogs and documentation inside <pre> or <code>.
• ASCII-only systems — some email builders, SMS gateways, XML feeds or old databases.
• Invisible or confusable characters — &nbsp;, &shy; and zero-width characters are clearer as entities.
• Not needed for Hindi, accented letters or emoji on pages served as UTF-8 — type them directly.

Decoding Entities

Text copied from page sources, RSS feeds, APIs or databases often arrives full of entities: Tom & Jerry, café, ₹500. Switch to Decode and paste it to get readable text. The decoder understands the full list of HTML5 named entities (over 2,000) and all numeric forms, because it uses the browser's own HTML parser. Double-encoded text such as & decodes one level at a time — press “Use result as input” and decode again.

How the Tool Works

Encoding walks through your text one Unicode code point at a time (not one UTF-16 unit), so emoji and other characters beyond U+FFFF are converted as a whole. The five special characters are always escaped; in named mode a small table of well-supported names is applied next; in numeric modes any character above the ASCII range (code point 127) becomes a decimal or hexadecimal reference. Decoding hands the text to the browser's standards-compliant HTML parser inside an isolated, script-free document and reads back the plain text, which is why every one of the 2,000+ HTML5 named entities is recognised. No text is sent anywhere.

HTML Email and Entities

Email clients are less forgiving than browsers. Some older clients or sending platforms mangle non-ASCII characters if the message encoding is not declared correctly, turning “₹” or “—” into odd symbols. Numeric references such as ₹ and — survive almost any pipeline because they are plain ASCII. When designing newsletter templates, run special symbols through numeric mode, keep normal letters as they are and always send a test email to several clients before a campaign.

Common Uses

• Displaying code snippets in blog posts and documentation.
• Preparing text for HTML email templates.
• Cleaning entity-filled text exported from CMSs and feeds.
• Escaping values before placing them in HTML attributes by hand.
• Converting Hindi text to ASCII-safe references for legacy systems.
• Learning how HTML parsing and XSS defences work.
• Showing HTML examples inside forum posts or comment boxes that accept limited markup.

Common Mistakes to Avoid

• Escaping twice — &amp;lt; shows “&lt;” on screen instead of “<”.
• Forgetting the semicolon — browsers often guess, but not always correctly.
• Escaping for the wrong context — HTML escaping does not make text safe inside JavaScript strings or URLs.
• Using entities instead of UTF-8 for every Hindi letter — it bloats pages and is hard to edit.
• Unquoted attributes — always quote attribute values, then escape the quotes.

Troubleshooting

• Entities still visible on the page — the text was encoded twice; decode once.
• Question marks or boxes — the page is not served as UTF-8; add <meta charset="UTF-8"> or use numeric mode.
• A named entity did not decode — check spelling and the trailing semicolon.
• Single quotes look unchanged in named mode — they are escaped as the numeric &#39;, which is the most compatible form.
• Line breaks disappeared on the page — HTML collapses new lines; wrap the encoded text in a pre element or convert breaks to br tags.

Quick Glossary

• Entity: a code like &amp; representing a character in HTML.
• Named entity: an entity with a name, such as &copy;.
• Numeric character reference: &#169; or &#xA9;, by code point.
• Escaping: converting special characters so they are treated as text.
• XSS: cross-site scripting, injecting scripts through unescaped input.
• Code point: a character's number in Unicode, such as U+0928.

Why Use This HTML Encoder?

It offers the right level of escaping for each job, handles Hindi and emoji correctly, decodes every entity safely and explains when entities are really needed — free, instant and private.

HTML Entity Encoder / Decoder — Key Facts

Frequently Asked Questions

Explore More Prompt Minds Tools

HTML Entity Encoder / Decoder works great alongside our other free tools. Every Prompt Minds tool runs entirely in your browser — no sign-up, no uploads, no watermarks. Browse all free tools.