HTML Entities Encoder & Decoder Privacy: local processing only

Encode, decode, validate, and look up HTML entities locally in your browser. Supports named, decimal, and hexadecimal references.

Scope:

Format:

Preserve existing entities

Encode line breaks

Examples:

📄Drop .txt, .html, .xml, .svg, .md file or click to browse

0 chars

Mode:

Decode repeatedly until stable

Examples:

📄Drop file to decode

0 chars

Char	Named	Decimal	Hex	U+	Description	Copy

How HTML Entities Work

What Are HTML Entities?

HTML entities are text sequences that represent characters using references rather than literal characters. They start with & and end with ;. They exist because certain characters (<, >, &, ") have special meaning in HTML syntax.

Named, Decimal, and Hexadecimal Entities

Named: &, <, © — human-readable, but only available for characters in the HTML specification's named character reference table.

Decimal numeric: &, © — works for any Unicode code point.

Hexadecimal numeric: &, © — same coverage as decimal, common in developer contexts.

Encoding Scopes

Minimum HTML escape encodes only the five reserved characters: &, <, >, ", '. This is sufficient for most HTML text and attribute contexts.

All non-ASCII additionally encodes characters outside the ASCII range (code points > 127), useful when you need ASCII-safe output.

All characters encodes every code point, useful for debugging or viewing exact entity representations.

Strict vs. Loose Decoding

Loose mode (HTML-compatible) decodes entities the way browsers do: it handles missing semicolons for legacy named entities, ignores unknown entities, and replaces invalid numeric references with the replacement character (�).

Strict mode reports errors for missing semicolons, unknown named entities, and invalid numeric references instead of silently fixing them.

Double-Encoded Entities

Double-encoding happens when already-encoded text is encoded again: & becomes &amp;. This tool detects double-encoding candidates and can preserve existing entities to avoid this common bug. Use "Decode repeatedly until stable" to unwrap multiple layers.

HTML Entity Encoding and Security

Encoding <, >, &, quotes, and apostrophes helps prevent text from being misinterpreted as HTML markup in HTML text content and quoted attribute value contexts. This is an important defense layer.

However, HTML entity encoding is not a complete XSS solution on its own:

JavaScript contexts (inline scripts, event handlers) need JavaScript string escaping.
URL contexts (href, src) need URL validation and encoding. See URL Encode/Decode.
CSS contexts (style attributes) need CSS escaping.
Unquoted attributes can be broken without any special characters.

Use textContent, framework auto-escaping, or a trusted encoding library when inserting untrusted text. Use a dedicated HTML sanitizer (like DOMPurify) when allowing user-provided HTML markup.

HTML Entities vs. URL Encoding

HTML entities (&) and URL encoding (%26) serve different purposes. HTML entities represent characters in HTML documents. URL encoding represents characters in URLs. They are not interchangeable. Use URL Encode/Decode for URL contexts.

Privacy and Local Processing

All encoding, decoding, and validation happens in JavaScript in your browser. No text, files, or results are sent to any server. Verify in DevTools → Network tab.

FAQ

Is my text uploaded?

No. All processing runs locally in your browser. Nothing is sent to any server.

What is an HTML entity?

A text sequence like & or & that represents a character using a reference rather than the literal character.

What is the difference between named, decimal, and hex entities?

Named entities use a word (©), decimal uses a base-10 number (©), and hex uses base-16 (©). They all represent the same character.

Should I encode every character?

Usually no. Encode only the characters that could be misinterpreted in your specific context. For HTML text content, encoding &, <, and > is typically sufficient.

Why did & become &?

The ampersand starts HTML entities, so literal ampersands must be encoded as & to avoid being parsed as entity references.

Why did &amp; appear?

This is double-encoding — the text was encoded twice. Enable "Preserve existing entities" to avoid this, or use the Validate mode to detect it.

Can HTML entities prevent XSS?

Entity encoding helps in HTML text and quoted attribute contexts, but it is not a complete solution. JavaScript, URL, CSS, and event handler contexts need different escaping. Use a sanitizer for user-provided HTML.

Is this the same as URL encoding?

No. HTML entities (&) are for HTML documents. URL encoding (%26) is for URLs. They are different systems for different contexts.

What is  ?

A non-breaking space (U+00A0). It prevents line breaks between words and renders as a space that won't collapse in HTML.

Are semicolons required?

The HTML spec requires semicolons for all entities. However, browsers accept some legacy named entities without semicolons for backward compatibility. Always include semicolons in new content.

Why are some entities decoded without semicolons?

HTML parsers handle "legacy" named entities (like &copy without ;) for backward compatibility. Strict mode will flag these as errors.

Can I decode malformed entities?

Yes. Loose mode handles malformed entities like browsers do. Strict mode reports them as errors so you can fix them.