Online HTML entity encoder and decoder. Convert <, >, &, " and other special characters to HTML entities, or decode them back. Processed locally in your browser.
TL;DR: Free online HTML entity encoder and decoder. Convert special characters like angle brackets and ampersands to HTML entities or decode them back. Runs locally, no registration.
For local tools, open DevTools → Network and search your input — it should not appear in requests.
Next steps
Usage Guide
Encode/decode HTML entities locally for safe text in HTML contexts.
1. Use
Pick encode/decode, paste only the text nodes/attributes that need it.
2. When
UGC, code samples in HTML, email HTML — avoid double-escaping.
3. Not encryption
Entities are reversible syntax, not confidentiality.
4. Named vs numeric
Common forms decode together; encode covers the risky core set.
5. With Markdown
Decode leftovers from rich paste; encode before emitting HTML.
6. Accept
View source to ensure tags were not injected.
FAQ
Encode characters like <, >, &, and " before placing them into HTML text or attributes. Otherwise the browser parses them as tags or entities, causing broken layout or even XSS injection points. User comments, code samples, and HTML emails are the classic high-risk spots.
Two cases call for restraint: blindly encoding an entire HTML document turns its tags into visible text, and encoding on top of a template engine that already auto-escapes double-escapes the content, so the page shows a literal < instead of <. Only escape content destined for text nodes or attributes.
Common named entities like < > & " , plus bidirectional conversion between numeric entities (e.g. <) and named ones. Note that ,  , and   often represent the same gap; specialized typographic entities are outside the default set and can be added by hand.
No. Entity encoding is readable syntax escaping — anyone can turn < back into <. Confidentiality should rest on HTTPS, real encryption, and access control; raw text can still surface in logs, so never treat escaping as a security boundary.
Pastes into Markdown or rich-text editors often carry or & residue. Switch to decode mode and restore the entities to characters before formatting — that is safer than regex-stripping them, which easily eats legitimate symbols in the text.
No. The page works as soon as it opens — encoding and decoding finish instantly, with no usage caps and no account system.
Related Tools
Related Articles
Online HTML Entity Encoder/Decoder: Safely Handle Special Characters
Learn HTML entity encoding fundamentals. Understand how to convert special characters to HTML entities, prevent XSS attacks, and use encoding in frontend development.
Unexpected token '<' is not valid JSON — 5 Reasons Your API Returned HTML Instead
fetch throws SyntaxError: Unexpected token '<' when the response body is HTML, not JSON. Covers the 5 root causes: SPA history fallback returning index.html, auth 302 redirects, gateway 502 error pages, wrong baseURL, and missing res.ok checks — with curl diagnostics.
HTML Table to JSON: How to Preserve Rows, Columns and Structure
Converting an HTML table from a web page to JSON — how to keep headers, handle merged cells and nested structure? Step-by-step with our HTML table to JSON tool.