Written by Alex Chen · Reviewed by Sarah Mitchell · July 22, 2026
Convert special characters to HTML entities and decode entities back to plain text. Handles &, <, >, ", ', and more.
The encoder works on exactly five characters: the ampersand, the less-than and greater-than signs, and the two quote characters. Those are the only characters the HTML parser reads as syntax, so they are the only ones the tool touches. A paragraph full of accented letters or emoji passes through unchanged, because modern pages declare UTF-8 and have no need to escape those glyphs. The encoder is for people hand-building HTML who want a string like Tom & Jerry's Pizza to display literally instead of being mistaken for markup.
The encoder applies five ordered replacements: & becomes &, then < becomes <, then > becomes >, then " becomes ", and finally ' becomes '. The order is deliberate. The ampersand goes first so that the ampersand inside a freshly written < is not itself re-escaped, which would turn clean output into &lt;. The single quote is written in its numeric form, ', rather than the named ', because the numeric version is understood by every browser and every HTML version while the named form was missing from older standards.
Paste the fragment <div> & "quotes" into the box and click Encode. The ampersand goes first, producing <div> & "quotes". The opening bracket becomes <div>, then the closing one, <div>, and finally the double quotes, <div> & "quotes". That is the whole run in one pass. Copy the result into the Decode box and you recover the original fragment byte for byte. A round trip is the fastest sanity check: encode a sentence, decode it again, and confirm the two match.
Decoding never scans the string looking for entity names. Instead the tool assigns the input to a hidden textarea's innerHTML, lets the browser's own parser resolve whatever entities it finds, then reads back the plain text value. That one step handles every entity the rendering engine knows, not just the five the encoder writes. Paste © and the decoder returns the copyright symbol; becomes a non-breaking space. It also means decoding is only as smart as the browser's parser — an entity it does not recognize, such as &madeup;, comes back as the literal text rather than an error.
The five characters prevent the most common form of HTML injection, but they are not a complete security layer. Text destined for a script block, a style attribute, or a URL still needs context-specific handling, because the escaping rules inside those contexts differ from the rules for element content. Encoding is also not encryption: the output is trivially reversible by design, so it protects page structure and never secrets. Watch for double encoding, the classic failure. Run the encoder twice and a single ampersand ends up as the seven-character string &amp;, which a browser displays as literal & text. If your output ever looks like &lt;, the input was already encoded and someone applied the encoder one time too many.
Escaping operates on the five metacharacters alone, so everything else survives the trip untouched. Whitespace is passed through byte for byte: leading spaces, tabs, and line breaks are not collapsed, trimmed, or converted, which matters when you are encoding a code sample whose indentation you want to preserve. The replacement is case-sensitive, so a lowercase < you paste as plain text is left alone because it is not one of the five characters the tool looks for. The tool also makes no effort to escape XML-specific constructs such as CDATA sections or to guard attribute delimiters beyond the quotes it already handles — the five-character set is the intersection that works everywhere, and staying deliberately narrow keeps the output predictable.
The encoder writes the numeric form ' because it is valid in every HTML version and every browser. The named form ' only became part of the standard in HTML5, so older parsers leave it as literal text.
No. The tool only replaces the five special characters. A string like café ☕ passes through untouched, which is exactly what a UTF-8 page wants.
Because the first pass turned every & into &, and the second pass encodes those new ampersands too. Round-trip the output to recover the original text.
No. URL components need percent-encoding and script content needs its own escaping strategy, so this five-character set covers neither context. Use a URL encoder for links and treat script content with the escaping rules that context requires.
Yes, that is the tool's main job. Encoding a snippet keeps the browser from rendering it as markup, which is why forum software and CMS editors rely on the same five characters.
Reach for it when you are hand-writing an email template, drafting a CMS article that stores raw markup, or showing code samples on a page that renders HTML. Skip it when the platform already escapes input for you, when the text is going into a script or style context, or when you need to protect a database query — escaping HTML does nothing for SQL. The five characters it handles are the ones that actually break HTML; everything else is a rendering decision, not a safety one.