MSMuhammad Shahid

Free tool · runs in your browser

HTML encoder and decoder

Convert special characters to HTML entities so they show as text, and turn entities back into characters.

Quick answer

HTML encoding replaces characters that have a special meaning in HTML: & becomes &amp;, < becomes &lt;, > becomes &gt;, and quotes become &quot; and &#39;. Browsers then show them as text rather than reading them as code. Paste your text to encode it, or switch to Decode to turn any named or numeric entity back into its character.

How to use it

  1. Choose encode or decode. Encode for putting text in HTML; decode for reading entities.
  2. Paste your text. The result updates as you type.
  3. Copy the result. Choose whether to encode just the special characters or more.

Example

A tag becomes text that a browser shows rather than runs:

Input

<p>Tom & "Jerry"</p>

Output

&lt;p&gt;Tom &amp; &quot;Jerry&quot;&lt;/p&gt;

Common errors and how to fix them

The page shows &amp;amp;
The text was encoded twice. Encode only once, or decode it once more.
Entities show as plain text
Your framework may already be encoding the text. React and Vue do this automatically, so do not encode it again.

Frequently asked questions

What are HTML entities?

Codes that stand for characters, written with & and ;, such as &lt; for < and &copy; for ©. They can also be numeric, such as &#169;.

Which characters must be encoded?

In text, & and <. Inside attribute values, also the quote that surrounds the value. Encoding > as well is common and harmless.

How do I show HTML code on a web page?

Encode it first, so <p> becomes &lt;p&gt;, then place it in the page, usually inside <pre><code>.

Does HTML encoding prevent XSS?

It is a key defence when putting user text into HTML, but the right escaping depends on the context, such as attributes, URLs and scripts. Use your framework's built-in escaping.

What is the difference between HTML encoding and URL encoding?

HTML encoding is for showing characters in a page (&amp;). URL encoding is for placing them in a web address (%26). Each has a different purpose.

Why does &amp;amp; decode to &amp;?

Decoding happens only once, so double-encoded text needs decoding twice. Seeing &amp;amp; on a page usually means something was encoded twice.

Do I need to encode accents and emoji?

Not with UTF-8, the default for modern pages, which can include them directly. The "non-ASCII" option is for older systems.

Is it safe to paste code here?

Yes. Your text is treated as text and is not run, and it stays in your browser.

Should I use HTML encoding in a URL?

No. Web addresses use percent-encoding, so use the URL encoder for those.

Is HTML encoding the same as Base64?

No. HTML encoding only replaces special characters. The Base64 encoder rewrites all the data into a different alphabet.

Sources

Related

More tools in this group

Guides and apps

By Muhammad Shahid. Last updated .