HTML Entity Encoder & Decoder
Escape and unescape HTML special characters.
About this tool
HTML entities keep <, >, &, and quotes from being parsed as markup — the difference between displaying code and executing it. This tool escapes the critical characters (or optionally everything non-ASCII) and decodes named, decimal, and hexadecimal entities.
Like everything on encrypt.tools, this runs entirely in your browser — nothing you enter is transmitted or stored.
Frequently asked questions about HTML Entities
Why encode HTML entities?+
Escaping <, >, &, and quotes prevents user content from being parsed as markup — the core defense against many cross-site scripting (XSS) bugs.
What forms of entities can it decode?+
Named (&), decimal (&), and hexadecimal (&) entities all decode back to their characters.
What does 'encode non-ASCII' do?+
It additionally escapes every character above ASCII as a numeric entity — useful for environments that can't handle UTF-8 directly.