HTML encoder / decoder
Encode special characters to HTML entities or decode entities back to readable text. Instant results.
Ctrl + L clear | Ctrl + Shift + C copy output
What are HTML entities and why do they matter
HTML entities are special codes that represent characters which have meaning in HTML markup. The five most critical characters are the ampersand (&), less-than sign (<), greater-than sign (>), double quote ("), and single quote ('). These characters are used to define HTML tags and attributes, so when you want to display them as literal text rather than HTML syntax you must encode them as entities. Without encoding, a less-than sign could be interpreted as the start of an HTML tag and break your page layout.
When to encode HTML
Encode HTML whenever you are inserting text into an HTML document that might contain special characters. The most common scenarios are displaying user-generated content such as comments or form submissions, showing code snippets on a page, inserting data from a database into HTML, and generating HTML programmatically. Failing to encode user input is one of the most common sources of cross-site scripting (XSS) vulnerabilities — a security flaw where malicious users inject scripts into your page through unencoded input.
Named entities vs numeric entities
HTML entities can be written in two formats. Named entities use a descriptive name — & for ampersand, < for less-than, © for the copyright symbol. Numeric entities use the Unicode code point — & for ampersand, < for less-than, © for copyright. Named entities are more readable but not all characters have named versions. Numeric entities work for any Unicode character. Both formats produce identical results in the browser.
Decoding HTML entities
HTML decoding converts entities back to their original characters. This is useful when you receive HTML-encoded text from an API or database and need to display or process the plain text version. Switch to Decode mode and paste your encoded HTML — all entities including both named entities like & and numeric entities like & are converted back to their characters.
Frequently asked questions
Why does & show up in my text instead of &?
That is double encoding — text that was already HTML-encoded got encoded a second time, turning & into &amp;, which then displays as the literal string "&". It usually happens when a CMS, feed or API encodes content that a template encodes again. The fix is to decode once: paste the text here in Decode mode, and repeat if the text was encoded multiple times — each pass unwraps one layer until the plain characters emerge.
How does HTML encoding prevent XSS attacks?
Cross-site scripting works by sneaking executable markup — typically a <script> tag — into content a page displays. Encoding defuses it: once the less-than sign becomes <, the browser renders the attack as harmless visible text instead of executing it. That is why the golden rule of web security is to encode all user-supplied content at the point of output. This tool applies the same transformation web frameworks perform, which makes it useful for testing what properly encoded output should look like.
What is the HTML entity for an ampersand?
& — and it is the most important entity of all, because the ampersand is the character that begins every entity. An unencoded ampersand in HTML is ambiguous: the browser cannot tell whether "©" means the copyright symbol or the literal text. The other four critical entities are < for <, > for >, " for double quotes and ' for single quotes. Encode the ampersand first when doing it manually, or the other entities get corrupted.
What is the difference between HTML encoding and URL encoding?
They protect different contexts. HTML encoding turns markup-significant characters into entities (<) so text displays safely inside a web page. URL encoding turns characters that are illegal or meaningful in web addresses into percent sequences (%20 for a space) so they travel safely inside a URL. The same string often needs both, applied separately: a search term goes URL-encoded into the query string, then HTML-encoded when echoed back onto the results page. TextlyPop has a separate URL encoder/decoder for the other half of the job.
Does this tool encode all special characters?
By default it encodes the five characters that actually endanger HTML — ampersand, less-than, greater-than, and both quote styles — which is the correct minimal encoding for modern UTF-8 pages, where accented letters and emoji are safe as-is. Enable Encode all non-ASCII when targeting systems that cannot handle Unicode: every character outside basic ASCII then becomes a numeric entity like é for é, guaranteeing the text survives even in legacy email templates and old databases.