2026topopentools

HTML Entity Encoder / Decoder

Escape special characters like &, <, and > into safe HTML entities, or decode named and numeric entities back into plain text — instantly and entirely in your browser.

Result appears here…

Your text is processed entirely in your browser — nothing is uploaded or stored.

Understanding the HTML Entity Encoder / Decoder

The HTML Entity Encoder / Decoder converts special and non-ASCII characters into safe HTML entities and back again. Encoding escapes the five reserved characters (& < > " ') into named entities and turns every accented letter, symbol, or emoji into a numeric entity so it renders correctly inside HTML. Decoding reverses the process, restoring named, decimal, and hexadecimal entities to plain text. It is built for web developers, content editors, and anyone pasting code or copy into HTML who needs to avoid broken markup or injection. Everything runs locally in your browser — your text is never uploaded, logged, or stored.

How it works

For encoding, the tool first replaces every ampersand with &amp; so existing characters aren't double-escaped, then swaps < > " and ' for their named entities (&lt;, &gt;, &quot;, &#39;). It next walks the string character by character using code points, and any character above 127 (accents, symbols, emoji, including astral-plane characters) becomes a numeric entity like &#233; or &#128512;. For decoding, the input is parsed as an HTML document with the browser's built-in DOMParser and the resulting textContent is read back, which natively resolves named, decimal (&#169;), and hexadecimal (&#xA9;) entities in one pass.

Worked example

Type <p>Café © 2026</p> in Encode mode. The tool escapes the angle brackets and converts the non-ASCII characters, producing &lt;p&gt;Caf&#233; &#169; 2026&lt;/p&gt; — safe to drop straight into an HTML file. Switch to Decode mode, paste that exact string back, and it returns the original <p>Café © 2026</p>. The é (code point 233) and © (code point 169) round-trip perfectly, and an emoji like 😀 would encode to &#128512; and decode right back.

Tips & common mistakes

  • Encode user-supplied or pasted text before inserting it into HTML to prevent broken layout and reduce cross-site scripting risk.
  • Always process the ampersand (&) first when encoding, otherwise the & inside entities you add gets escaped again into &amp;amp;.
  • Both decimal (&#169;) and hexadecimal (&#xA9;) numeric forms decode to the same character — emoji are often written in hex like &#x1F600;.
  • Single quotes have no universally supported named entity (&apos; fails in older HTML), so this tool outputs the safe numeric &#39; instead.
  • Encoding here targets HTML — it is not the same as URL percent-encoding (%20) or Base64; use the matching tool for those contexts.
  • Whitespace, tabs, and line breaks are preserved as-is, so your formatting survives a full encode-then-decode round trip.

Related tools

JSON Formatter & ValidatorFormat, beautify, minify, and validate JSON with clear error messages.Base64 Encode / DecodeEncode text to Base64 or decode Base64 back to text, with full Unicode support.URL Encode / DecodePercent-encode or decode text for safe use in URLs and query strings.Hash GeneratorGenerate MD5, SHA-1, SHA-256, and SHA-512 hashes from any text.

Frequently Asked Questions

Does it decode numeric entities like &#169;?

Yes. The decoder handles named entities (&amp;, &copy;), decimal numeric entities (&#169;), and hexadecimal numeric entities (&#xA9;) — all are converted back to their original characters.

Does it handle emoji and other Unicode?

Yes. When encoding, every non-ASCII character — including accented letters and emoji — is converted to a numeric entity such as &#128512;. Decoding turns those numbers back into the original characters.

Is my text private?

Yes. All encoding and decoding happen locally in your browser using JavaScript. Your text is never uploaded to a server or stored anywhere.