How do I encode special characters as HTML entities?

Select Encode, paste your text or HTML into the input, and the Encoded HTML output updates as you type. Choose Named, Decimal or Hex entities, then use Copy. A count shows how many characters were encoded.

How do I decode HTML entities back to normal text?

Switch to Decode and paste text containing entities such as & or A. The tool turns named, decimal and hex entities back into characters and shows how many entities were decoded.

How do I encode accented letters, emoji and other non-ASCII characters?

Turn on Encode all non-ASCII. Every character above the ASCII range is then converted to an entity in your chosen style, instead of only the common special characters such as angle brackets and ampersands.

Is HTML encoding enough to prevent XSS?

Encoding user text before placing it in an HTML element body stops tags from being treated as markup. It is not a full defense in every context, such as scripts or URLs, so also use your framework's escaping.

Can I check my result by decoding it again?

Yes. Use the Use as input button to move the output into the input, then switch mode. Decoding the encoded result should return your original text.

Yes. Every tool is free to use, with no account and no credit card. The work runs on your device rather than on our servers, which is what keeps it free to run.

Does it work on mobile?

Yes. It runs in current mobile browsers on iOS and Android, with nothing to install.

🏷️

Free HTML Encoder & Decoder

Encode special characters to HTML entities or decode entities back to plain text. Instantly, in your browser.

Runs in your browserNo sign-up, no pop-upsNo login requiredFree forever

Works offline once loaded

Output:Named (&)Decimal (&)HexEncode all non-ASCII

Examples:

Plain text / HTML

Encoded HTML

Output will appear here...

Common HTML entities reference

©©

®®

™™

€€

——

……

Common uses

Encode Content for RSS FeedsEncode HTML content for RSS feed item descriptions — required by the RSS 2.0 standard.
Sanitise User Input for HTML OutputEncode user-provided strings before inserting them into HTML — prevents XSS injection attacks.
Encode Special Characters for HTML EmailEncode characters like &, <, >, and © as HTML entities so they render correctly in all email clients.
Encode User Content for Web DisplayPrevent XSS attacks by encoding user-generated content before rendering it in HTML pages.
Encode Content for XMLEncode special characters for XML files, RSS feeds, sitemaps, and SOAP payloads.

How It Works

HTML encoding and decoding here runs entirely in your browser using hand-written regex replacement and a hardcoded named-entity lookup table — no third-party encoding library, no server round-trip. For decoding uncommon named entities (like á or “), the tool delegates to the browser's own HTML parser as a zero-cost fallback.

1
Regex scans for characters to replace
On encode, one of two Unicode-aware regexes runs across your input: a targeted pattern covering ~25 common HTML-significant and special characters, or a broader pattern that catches every code point above U+007F. Each match is intercepted character by character.
2
Lookup table or codePointAt() produces the entity
For named-entity output, matched characters are looked up in a hardcoded table (e.g. & → &, © → ©). For decimal or hex output, String.codePointAt() gets the Unicode code point and formats it as &#NNN; or &#xNNN; — surrogate pairs are handled correctly because the regex uses the Unicode 'u' flag.
3
Single-pass regex decodes entities back to characters
On decode, a single regex pass identifies all entity tokens (&, A, A, etc.) and routes each to the right handler: hex parseInt(base 16), decimal Number(), named reverse-lookup, or — for any entity not in the hardcoded table — a textarea element whose innerHTML the browser parses natively, returning the correct character from the browser's built-in entity table.
4
Result appears instantly; copy to clipboard via Clipboard API
Output is recomputed synchronously on every keystroke via React useMemo. Copying uses navigator.clipboard.writeText() — the modern async Clipboard API — with a silent catch for restricted contexts.