Which characters are encoded?
The encoder safely escapes ampersands, less-than, greater-than, double quotes, and single quotes.
← Back to all tools
Text
HTML Entity Converter
Escape or decode the five essential HTML text characters in your browser. This utility is not an HTML sanitizer or a context-aware XSS defense.
Privacy
Tool workspace
How HTML Entity conversion works
Select whether you want to encode special characters into safe HTML entities, or decode them back to text. The tool escapes characters like <, >, &, ", and '.
Use cases
Encode code snippets to display them safely on web pages without the browser parsing them as actual HTML. Decode obfuscated entities back into readable source code.
Privacy
All conversions are performed locally in your browser memory. Your data is never sent to a server.
Limitations
This is a small text-escaping utility, not an HTML sanitizer or a context-aware XSS defense. Do not use it to validate untrusted HTML, URLs, CSS, or script content.
FAQ
Which entities does the decoder support?
It supports the named entities produced by this tool (&, <, >, ", and ') plus decimal (©) and hexadecimal (©) numeric references. Other named entities are left unchanged.
Is my data sent anywhere?
No. The encoding and decoding processes run entirely in your browser.
Does this tool prevent XSS?
No. It only escapes essential text characters and is not an HTML sanitizer or a context-aware XSS defense. All processing still happens locally in your browser.
Related tools
Text
URL Component Encoder / Decoder
Encode or decode a URL component with the browser's standard percent-encoding APIs. This tool does not parse or normalize whole URLs.
Text
Text Converter
Convert rich text into HTML, Markdown, and JSON in your browser with sanitized preview, copy actions, downloads, and clear document stats.
Codes
HTML Formatter
Format HTML markup locally in your browser with 2- or 4-space indentation controls, clear Prettier error feedback, and instant copy.