🌐 HTML Entity Encoder / Decoder

The HTML Entity Encoder / Decoder converts text between plain characters and HTML entities. Entities are how HTML represents characters that would otherwise be treated as markup (< becomes <), characters that can't be typed easily (© becomes ©), or bytes outside the document's character encoding (any Unicode character can be written as Ӓ or Ӓ). Use this whenever you need to safely display raw source code on a page, escape user input for output, or read entity-encoded text out of an old system.

How to Use This Tool

Paste text and press Encode to convert the five HTML-critical characters (& < > " ') plus any non-ASCII characters into named or numeric entities. Paste entity-encoded text and press Decode to see the plain-text result. Both directions handle both named entities (&, ©, °) and numeric entities (&, &) correctly.

SEO Best Practices

When outputting user-submitted content in HTML, always entity-encode at least the five critical characters — this is the single most reliable defence against basic cross-site-scripting bugs. When writing HTML by hand, only encode characters that actually have HTML meaning; over-encoding every letter makes source code unreadable. When storing text in a database, store the raw text and only encode at display time — don't save entity-encoded content, or you'll double-encode next time.

Example

Encoding "<div class='x'>A & B</div>" returns "<div class='x'>A & B</div>" — safe to paste literally inside a paragraph in a page, where it will render as visible source code rather than an actual div.

Common Mistakes to Avoid

Don't rely on entity encoding to prevent every kind of XSS — it stops the common cases in text contexts, but attributes, URLs, style, and script contexts each need their own escape rules. Don't decode untrusted input on the server and store the decoded form — you'll strip the protection. Don't confuse HTML entities with URL encoding or with Base64; they solve different problems.