Picsova

HTML Encoder / Decoder

Convert characters to HTML entities so markup in your content renders as text instead of being parsed, and decode entity-encoded HTML back to readable characters.

Runs entirely in your browser. Nothing is uploaded.

The five that matter

  • &&
  • <&lt;
  • >&gt;
  • "&quot;
  • '&#39;

Encoding &, < and > is what stops markup in your content being parsed as markup. Quotes matter when the value goes inside an HTML attribute.

Escape & unescape HTML entities

If you want to show a code sample on a page, or store user text that might contain a stray angle bracket, the characters that mean something to the HTML parser have to be encoded first. Otherwise the browser reads them as markup and your content disappears — or worse, executes. This tool encodes in both a minimal mode for the characters that matter and a full mode that also escapes non-ASCII, and decodes using the browser's own parser so every named entity resolves correctly.

How to encode and decode HTML entities

  1. 1

    Pick a direction

    Encode plain text into entities, or decode entity-encoded HTML back to characters.

  2. 2

    Choose the scope

    Escape only the HTML-unsafe characters, or also convert every non-ASCII character to a numeric entity.

  3. 3

    Copy the result

    Take the encoded or decoded output straight into your template or database.

Good to know

  • Five characters do the real work: & < > " and '. The ampersand must be encoded first, or every entity after it gets double-encoded.
  • Quotes only matter when the value sits inside an HTML attribute, but encoding them is harmless and safer by default.
  • Escaping non-ASCII is useful for systems with unreliable encoding handling, though a correct UTF-8 pipeline makes it unnecessary.
  • Encoding output correctly is a large part of preventing XSS, but not a complete defence — HTML, attributes, JavaScript, and URLs each need their own escaping rules.

What people use it for

  • Displaying a code sample on a web page without it being parsed
  • Decoding entity-mangled text pulled out of a feed, export, or CMS
  • Escaping user-supplied content before it is written into a template

Frequently asked questions

Which characters need encoding?+

Ampersand, less-than, and greater-than always, because they are what the parser treats as markup. Encode quotes too when the value goes inside an HTML attribute.

Does encoding prevent XSS?+

Encoding output in the right context is a large part of it, but it is not a complete defence on its own. Escaping rules differ inside HTML, attributes, JavaScript, and URLs, and a real application needs the correct one for each.

How does decoding handle named entities?+

It uses the browser's own HTML parser, so every named entity the browser knows — &eacute;, &nbsp;, &hellip; and the rest — decodes correctly, without relying on a partial lookup table.

Is my data sent to a server?+

No. Encoding and decoding happens entirely in your browser using built-in web APIs. Nothing is uploaded, stored, or logged.

Related tools

JSON Formatter

Beautify, minify & validate JSON

Base64 Encode / Decode

Text ⇄ Base64

URL Encode / Decode

Escape & unescape URL components

JWT Decoder

Inspect JSON Web Tokens

Or browse all 50 free tools.