HTML Entity Encoder / Decoder

Instantly encode special characters to HTML entities, or decode HTML entities back to raw text

What is an HTML Entity?

An HTML entity is a piece of text (a code string) that starts with an ampersand (&) and ends with a semicolon (;). Entities are used to display reserved characters and invisible characters in web browsers without parsing them as actual HTML code.

For example, in HTML, the character < (less than) is reserved for opening tags (like <div>). If you type a raw < on your page, the browser will expect a tag and break your layout. To safely display the < symbol as text, you must write its HTML entity: &lt;.

How to Use the HTML Entity Encoder/Decoder

Our free online encoder and decoder translates text instantly. Follow these steps:

  1. Enter your code or text — Paste raw HTML or text in the first editor box.
  2. Encode or Decode — Click the corresponding action:
    • Encode HTML Entities: Converts reserved markup characters (<, >, &, ", ') into safe entity strings.
    • Decode HTML Entities: Translates entity strings (like &lt;div&gt;) back into readable raw tags (like <div>).
  3. Copy Result — Click the “Copy Result” button to save it directly to your clipboard.

Common HTML Entities Reference

Here are the most frequently used HTML characters and their entity replacements:

Character Entity Name Entity Number Description
< &lt; &#60; Less than / angle bracket open
> &gt; &#62; Greater than / angle bracket close
& &amp; &#38; Ampersand character
" &quot; &#34; Double quotation mark
' &apos; &#39; Single quotation mark / apostrophe

Why Encoding is Crucial for Web Security

HTML entity encoding is a key defense mechanism against **Cross-Site Scripting (XSS)** vulnerability attacks. When building web forms (comments, search inputs), malicious users can attempt to input script tags: <script>maliciousCode()</script>. If a website renders this input directly as raw HTML, the browser will execute the script, exposing cookies and sensitive data. Escaping the input changes it to: &lt;script&gt;maliciousCode()&lt;/script&gt;, which causes the browser to safely render it as plain text instead of executing it.

Frequently Asked Questions

Is this encoder tool free?

Yes. The Toolfix HTML Entity Encoder/Decoder is 100% free with no registrations or limitations.

Does this tool support privacy?

Yes. All conversions are performed locally in your browser using client-side JavaScript. No data is sent to external servers, protecting your security keys and code blocks.

What is the difference between HTML encoding and URL encoding?

HTML encoding escapes characters to be displayed safely on an HTML page. URL encoding (or percent-encoding) converts characters into hexadecimal format (like %20 for spaces) to be safely transmitted as part of a web address query string.

Can it decode numeric entities?

Yes. Our browser-based decoding engine translates both named entities (like &amp;) and numeric entities (like &#38;) back into standard characters.