Free online HTML entity encoder/decoder supporting 244 named entities, with decimal/hexadecimal/named entity conversion.
TL;DR: Free online HTML entity encoder/decoder with 244 built-in named entities. Convert between decimal, hexadecimal, and named entities with multiple encode/decode modes, runs locally.
For local tools, open DevTools → Network and search your input — it should not appear in requests.
Usage Guide
Encode or decode HTML entities locally (named and numeric) for templates and CMS debugging — not a full XSS sanitizer.
1. Encode or decode
Paste text, pick direction, copy and verify.
- Paste.
- Encode/decode.
- Verify.
2. Common uses
Show code in HTML, email markup, undo & stacks — still not complete XSS defense.
3. Double encoding
Decode one layer at a time.
- One layer.
- Compare expected.
- Not the only defense.
4. Scope
Enhanced entity helper — use a real sanitizer for untrusted HTML.
5. Invisible chars
Follow up with unicode tools if output still looks odd.
6. Handoff
State encode vs decode and how many layers.
FAQ
Yes: encoding and decoding run entirely on this page and nothing is sent out. Local processing isn't zero risk, though — screen shares, recordings, and downloaded files can still spread the content further, so use judgment with sensitive material.
The enhanced version covers 244 named entities (Latin, Greek, math symbols, currency, punctuation, and more), with three encode modes — special chars only, all encodable chars, named entities first — and two decode modes: decode all and named entities only.
Yes. When encoding, non-named characters fall back to a named entity or a decimal &#NNN; form; when decoding, decimal &#NNN;, hexadecimal &#xNN;, and named &name; entities are all recognized.
Decode one layer at a time and compare against the expected text after each pass — &lt; takes two rounds to get back to <, and rushing it in one go tends to over-decode. When handing off, say how many layers you decoded so a colleague doesn't re-encode it in a template and ship literal entity text.
It is the first step in placing user content into HTML, not a complete defense: attribute and URL contexts follow extra rules, so don't treat it as your only measure. Typical uses include showing code snippets in docs, preparing HTML email, and turning & back into & to read the real URL.
Zero-width characters or a BOM may be at play. Move to a Unicode tool to dig further, and turn on whitespace visibility in your editor to spot them. Reproduce with a minimal sample first to tell an input problem from an option-combination problem before switching tools.
Related Tools
Related Articles
Online HTML Entity Encoder/Decoder: Safely Handle Special Characters
Learn HTML entity encoding fundamentals. Understand how to convert special characters to HTML entities, prevent XSS attacks, and use encoding in frontend development.
Unexpected token '<' is not valid JSON — 5 Reasons Your API Returned HTML Instead
fetch throws SyntaxError: Unexpected token '<' when the response body is HTML, not JSON. Covers the 5 root causes: SPA history fallback returning index.html, auth 302 redirects, gateway 502 error pages, wrong baseURL, and missing res.ok checks — with curl diagnostics.
HTML Table to JSON: How to Preserve Rows, Columns and Structure
Converting an HTML table from a web page to JSON — how to keep headers, handle merged cells and nested structure? Step-by-step with our HTML table to JSON tool.