How do I use the HTML entity encoder / decoder?
- Paste the text or HTML.
- Choose Encode or Decode.
- Copy the result.
HTML entity encoder / decoder: frequently asked questions
Why escape HTML?
To show code or user input as text instead of letting the browser treat it as markup — and to prevent cross-site scripting.
Which characters must be escaped?
& < > in text, and " or ' inside attribute values.
Should I encode Arabic characters?
Usually not — UTF-8 pages display Arabic directly. Encode only for systems that cannot handle UTF-8.
Does it decode numeric entities?
Yes, both decimal (') and hex (') forms, plus common named entities.
Is this enough to prevent XSS?
Escaping is one layer. Use your framework’s built-in escaping and a Content Security Policy as well.
Is my text uploaded?
No. It runs in your browser.
What is ?
A non-breaking space that keeps two words on the same line.
What about URL encoding?
That is different — use our URL encoder for query strings.
Is there an API for this tool?
Selected tools are available through a rate-limited public API. Contact us if you need higher volumes.
Is the html entity encoder / decoder free?
Yes. It is free with no sign-up and no usage limits for normal use.