Skip to content
IPOK

HTML Entity Encode / Decode

Writing < > & " ' directly in HTML breaks structure or is read as tags, so they must be escaped into entities (&lt; &gt; &amp; …). Escaping user input also prevents XSS. This tool converts both ways: encode turns special chars into entities (optionally Unicode / emoji into &#… too), decode turns entities back to plain text.

Decoding uses the browser natively, supporting named entities (&copy;) and numeric ones (&#169; / &#xA9;). All local, never uploaded.

Local, never uploaded. Escaping < > & " ' into HTML entities prevents content being parsed as tags (anti-XSS / showing source). Decoding uses the browser natively, supporting named and numeric entities.

Check your exit IP's purity while you're here →
Check your own IP — purity, risk score, native vs datacenter, leaksCheck IP →

FAQ

Why escape HTML special characters?

To stop < > & being parsed as tags / entities, which breaks structure or enables XSS; also needed to display source code.

What's the difference between &amp; and &#38;?

Both represent the & character — one named, one numeric (decimal) — with identical effect. This tool encodes with the common form and decodes both.

Is my content uploaded?

No, all encoding / decoding happens locally in your browser.

More tools