How to use HTML Entity Encoder & Decoder — Escape HTML Online
- 1Choose the scheme you need, then encode or decode.
- 2Paste your text into the left-hand box.
- 3The converted result appears on the right — copy it, or press Swap to send it back through the other way.
About HTML Entity Encoder
If you have ever tried to show an HTML example on a web page and watched the browser render it instead of printing it, entity encoding is the fix. Replacing the five reserved characters with their entity forms makes the browser treat them as ordinary text.
Order matters when doing this by hand, which is a classic source of double-escaped output like <. The ampersand must be replaced first, because every other entity introduces one; get the order wrong and you escape your own escapes.
Decoding runs the other way, turning   and friends back into real characters — useful when content arrives from a CMS or an RSS feed already escaped, sometimes twice over.
Frequently asked questions
Which characters need escaping?
The five that matter are & < > " and '. Escaping the first three prevents your text being read as a tag; escaping the quotes matters when the text sits inside an HTML attribute.
Why does & have to be escaped first?
Because every other entity starts with it. If you replaced < before &, the ampersand in the resulting < would be escaped again and you would get &lt; on the page.
Does this make my site safe from XSS?
Escaping on output is a key part of preventing cross-site scripting, but it is not a complete defence on its own — the right escaping depends on where the value lands, and text inside a script tag or a URL attribute needs different treatment.
Can I paste code samples through it?
Yes, and that is the most common use. Running a code snippet through the encoder lets you display it in a page without the browser trying to execute or render it.
Is it free?
Yes — unlimited use, no sign-up, no watermark and no limit on how many times you run it.