HTML Encoder/Decoder
Encode or decode HTML entities. Fast, private, and easy to use.
Mode:
Entity Type:
Encode or decode HTML entities. Fast, private, and easy to use.
HTML encoding turns characters a browser would treat as markup into entity references that the browser displays literally. If you paste <strong>hello</strong> into a page as plain text, the browser sees a real bold tag; encode it first and the browser shows the tag itself. This tool encodes and decodes in both directions, with a safe mode for everyday escaping and a full mode that converts every non-ASCII character into a numeric reference. It is meant for developers, technical writers, and anyone who has to display code as text or clean up text that was escaped one too many times.
| Input | Safe mode | Full mode |
|---|---|---|
<p>café</p> | <p>café</p> | <p>café</p> |
He said "hi" | He said "hi" | He said "hi" |
€100 | €100 | €100 |
A & B | A & B | A & B |
Safe mode replaces exactly &, <, >, ", and ' (the apostrophe becomes '). Full mode does the same, then replaces any remaining character whose code point is below U+0020 or above U+007E with a decimal numeric reference. Printable ASCII from space through ~ is left alone. Full mode is the right choice when the output must survive a page or system that does not declare UTF-8, when you are producing a file that has to be pure ASCII, or when invisible control characters need to be made visible. Safe mode keeps the text readable to humans, which is usually what you want when the destination is already UTF-8.
HTML offers two ways to write a character that you cannot or do not want to type directly. A named entity such as & or < has a human-readable name and is easy to recognize. A numeric character reference writes the character’s Unicode code point, either in decimal (é) or hexadecimal (é). Both forms mean the same character to a browser. Full mode always emits decimal references because they are compact and unambiguous, and because decimal digits are readable ASCII. Knowing the code point is often the fastest way to decode a strange reference by hand: € is decimal 8364, which is U+20AC, the euro sign.
<div class="box">Hi</div> in either mode gives <div class="box">Hi</div>. Every character is printable ASCII apart from the five that are escaped, so safe and full agree.Résumé & Co. gives Résumé & Co. in safe mode and Résumé & Co. in full mode, because é is U+00E9, decimal 233.	 and the copyright sign (U+00A9) becomes ©, making both visible in the output.Hello gives Hello, and decoding <b>bold</b> gives <b>bold</b>.The decoder recognizes six named entities: &, <, >, ", ', and . It also handles decimal references such as é and hexadecimal references such as é or é. Anything else is passed through unchanged, so ©, €, and malformed fragments stay exactly as written. One subtlety worth remembering: decodes to an ordinary space, not a non-breaking space, so a decoded paragraph can reflow differently than the original page. Round-tripping is therefore not always lossless.
< again yields &lt;, which the browser displays as the literal text <. Decode first if you are unsure whether a string is already escaped.© and € will surprise you.Escaping the five characters prevents text from being read as markup, but it is not a sanitizer. It does not validate input, remove unwanted tags, or defuse dangerous URLs such as javascript:. If you need to render untrusted HTML rather than display it as text, pair escaping with a dedicated sanitizer. As a rule of thumb: escape when showing code or user text, sanitize when you must actually insert markup.
Technical writers use it to show HTML, XML, and SVG samples inside blog posts and documentation. Developers escaping user-submitted text before rendering it. Template authors protecting dynamic values inserted into HTML email. Anyone decoding garbled, entity-filled text copied from a legacy system or an over-eager CMS.
Safe mode replaces only five characters: ampersand, less-than, greater-than, double quote, and apostrophe. Full mode escapes those same five, then converts every remaining character below U+0020 or above U+007E into a decimal numeric reference, so the result is pure ASCII.
That is expected. Full mode represents every non-ASCII character as its decimal Unicode code point, so an accented letter or a currency symbol becomes something like é. This keeps the text readable on pages or systems that do not declare a UTF-8 charset.
No. This decoder maps to an ordinary space (U+0020), not a non-breaking space (U+00A0). Decoding and then re-encoding will not restore the original entity.
The ampersand in < is itself a character that safe mode escapes, so the input < becomes &lt;. That is double encoding: the browser displays the literal text < instead of the < character.
Yes. Full mode walks the string by Unicode code point, so an emoji is emitted as a single numeric reference such as 😀 rather than being split into surrogate halves.
No. Encoding the five dangerous characters stops text from being interpreted as markup, but it does not validate input, strip tags, or neutralize dangerous URLs such as javascript:. For rendering untrusted markup, use a purpose-built sanitizer.
Reviewed by the HandyTools Hub team · Last updated