HTML Entity Encode/Decode

HTML entity encoding replaces characters that have special meaning in HTML markup — &, <, >, ", ' — with a named or numeric escape sequence, so they render as literal text instead of being parsed as a tag, attribute boundary, or the start of another entity. &amp; renders as &, &lt; renders as <, and so on. Without this, user-submitted text containing < or & could break page layout or, worse, be interpreted as actual markup.

Entities come in two forms: named (&amp;, &copy;, &hellip;) and numeric (&#38; or &#x26; for the same &). Named entities are easier to read in source; numeric entities work for any Unicode character, even ones without a memorable name, using either decimal (&#NNNN;) or hexadecimal (&#xHHHH;) code points. This tool's decoder accepts both forms interchangeably, since real-world HTML mixes them freely — copy-pasted content, CMS exports, and RSS feeds often use whichever form the original tool happened to emit.

• •Encoding user input before rendering it as HTML is a basic XSS defense — but it's not a substitute for a proper templating engine or sanitizer that handles attribute contexts, URLs, and JavaScript contexts differently.
• •Only the five characters & < > " ' are strictly required for safe HTML embedding — encoding everything else (accented letters, emoji) as numeric entities is unnecessary today, since UTF-8 is universally supported.
• •Encode & first, before any other character — encoding < to &lt; and then encoding the & in that output would double-encode it into &amp;lt;, corrupting the entity.
• •When decoding content from an unknown source, treat the output as untrusted text, not as safe-to-render HTML — decoding entities does not itself make the content safe.