📜 HTML Entities Encoder / Decoder
Turn < into < so it displays instead of rendering — or decode &-style entities back to plain text.
& < > " ' escaped
How the html entities encoder / decoder works
Encoding escapes the five characters with special meaning in HTML — & < > " ' — into their entities, making arbitrary text safe to display inside markup. Decoding uses the browser’s own HTML parser, so it understands every named entity ( , —, ……) and numeric form (—), not just the common five.
This escaping is the last-line defense pattern against HTML injection when displaying user text — though in real applications, use your framework’s templating (which escapes by default) rather than manual encoding. For showing code snippets in a blog or CMS, encode-then-paste is exactly the right manual workflow.
Frequently asked questions
Which characters must be escaped in HTML?
The essential five: & (first!), <, >, and in attributes also " and '. Everything else can appear literally in UTF-8 documents.
Why must & be escaped first?
Because entities themselves contain & — escaping < after & would double-escape into &lt;. This tool applies the correct order automatically.
What is the difference between &#8212; and &mdash;?
The same em-dash: one numeric reference, one named entity. Decoding handles both, plus every other named entity the HTML spec defines.
Is encoding enough to prevent XSS?
For text content and quoted attributes, escaping these five characters neutralizes injection. But context matters (URLs, CSS, script blocks have different rules) — in applications, rely on framework auto-escaping and use this tool for manual/editorial tasks.
Is my content uploaded?
No — both directions run in your browser.