HTML Entities Encode / Decode
Convert characters like <, >, & and quotes into their HTML entity forms, or decode entity-riddled text back into something readable. Essential when debugging double-escaped output, preparing code samples for a blog, or checking what a template engine actually emitted.
How to use
- Paste raw text or entity-encoded HTML into the box.
- Choose Encode (text to entities) or Decode (entities to text).
- Copy the converted output.
HTML entities exist because five characters have grammatical meaning in HTML itself: < and > delimit tags, & starts an entity, and quotes delimit attribute values. To display them literally you write <, >, &, " and '. Entities come in three spellings, named (©), decimal numeric (©) and hex numeric (©), all rendering the same character.
Encoding these characters is also the core defence against cross-site scripting: if user input is entity-encoded before being placed into HTML, a submitted <script> tag renders as visible text instead of executing. Template engines like Jinja2, JSX and Django templates do this automatically, which leads to the most common real-world problem this tool solves: double escaping. When text is encoded twice, & becomes &amp; and users see raw entity codes on the page. Pasting the page source here and decoding once immediately shows how many layers of escaping were applied.
A few practical notes. In HTML5 you rarely need entities for characters like em dashes or arrows, declare UTF-8 and type them directly. Entities remain necessary only for the five syntax characters and for invisible characters like that you want to be explicit about. Also, attribute context matters: unquoted attribute values need more aggressive escaping than element text, so always quote your attributes. Decoding here handles all named HTML5 entities plus numeric forms in both bases.
Examples
Input: if (a < b && c > d) { alert("hi"); }
Output: if (a < b && c > d) { alert("hi"); }Input: Fish & Chips © 2026
Output: Fish & Chips © 2026Input: Tom &amp; Jerry
Output: Tom & Jerry (still encoded once, it was double-escaped)Frequently asked questions
Why does my page show & instead of &?
The text was escaped twice, usually once by your code and once by the template engine. Remove your manual escaping and let the template layer do it exactly once, or mark pre-escaped strings as safe.
Do I need to encode every non-ASCII character?
No. With a UTF-8 charset (the default in HTML5) you can type ©, ₹, é and emoji directly. Only <, >, &, and quotes inside attributes strictly require encoding.
What's the difference between © and ©?
Nothing visible, both render ©. © is a named entity, © is the decimal code point, and © is hex. Named entities are more readable. Numeric forms work for any Unicode character even without a name.
Does entity encoding prevent XSS completely?
It prevents injection into HTML element content, which is the most common case. Attribute values, URLs, CSS and inline JavaScript each need their own context-appropriate escaping, entity encoding alone is not sufficient in those contexts.
Related tools
Velona is India's INR-native AI API gateway with 300+ models, UPI top-up from ₹10, no foreign card needed. These tools are free forever.