norito / HTML Entity Encoder

HTML Entity Encoder / Decoder

Escape special characters into HTML entities, or decode entities back into plain text, live as you type.

Encode all non-ASCII characters
Also escapes accented letters and emoji, not just < > & " '.

Why HTML entities exist

Some characters are reserved by HTML itself.

Characters like <, >, and & have special meaning in HTML markup, typing them literally inside page content can break the page or, worse, let user input be interpreted as executable markup. Encoding them as entities like &lt; displays the character safely as plain text.

Named vs numeric entities

&amp; and &#38; both decode to the same ampersand, named entities exist for common characters, numeric entities (decimal or hex) can represent any Unicode character at all. This tool decodes both forms.

How it works

Encoding is a straightforward substitution: a regex replaces the five HTML-reserved characters (&, <, >, ", ') with their entities. The "encode all non-ASCII" option goes further and converts every character above the ASCII range to a numeric reference using codePointAt, handy when output has to survive an ASCII-only pipeline like an old email template system or a config file that mangles UTF-8.

Decoding uses a trick worth knowing: the string is assigned to the innerHTML of a detached <textarea>, then read back from its .value. That hands the work to the browser's own HTML parser, which already knows all 2,000-plus named entities plus every decimal and hex numeric form, so the tool doesn't ship a lookup table that can go stale. It's also why decoding untrusted input is safe here: a textarea's contents are always treated as plain text, so a decoded &lt;script&gt; becomes the text of a script tag, and nothing ever executes.

Both directions run on each keystroke inside this page's JavaScript. Open DevTools' Network tab while you type: there are no requests, your markup never leaves the browser.

Related tools

URL Encoder / Decoder Percent-encode or decode a URL. Base64 Encode / Decode Text to and from Base64, UTF-8 safe. JSON Formatter Format, validate, and minify JSON.

Common questions

Which characters get encoded by default?

The five HTML-significant characters: < > & " and '. Turn on "Encode all non-ASCII characters" to also escape accented letters, emoji, and other Unicode characters as numeric entities, useful for older systems that only handle plain ASCII safely.

Does this decode numeric entities like &?

Yes, both decimal (&) and hexadecimal (&) numeric entities decode correctly, alongside all the common named entities like &amp; and &copy;.

Is this safe to use on untrusted HTML?

This tool only converts text back and forth, it never renders the HTML as a live page, so pasting untrusted content here is safe. The encoded output is meant to be inserted into your own page's source where it will display as literal text rather than run as markup.