Developer Tools
HTML Entity Encoder & Decoder
Encode HTML-sensitive characters using minimal, named, decimal or hexadecimal entities, or decode one entity layer back into plain, non-rendered text.
Encode or decode HTML entities
HTML Entity Encoder & Decoder
Encode or decode HTML character references as plain text. Decoded markup is never rendered.
Preview is limited to 200,000 characters. Copy and Download include the full result.
How this tool works and limits
Uses locally bundled he 1.2.0 (MIT), a table-based HTML character-reference parser, not a DOM parser. Decode one level with HTML text-context semantics, including legacy semicolon-less references and numeric replacement rules. Unknown references stay literal. Minimal mode escapes &, <, >, quotes and apostrophes. Named mode prefers named references and uses numeric fallback; numeric modes encode Unicode code points, not surrogate halves. Invalid Unicode encoding is rejected. UTF-8 input limit: 1 MB. Copy/download remain inert text.
Your input is processed locally in your browser and is not uploaded or stored by this tool.
Processing runs locally. Output stays in a plain-text field, but decoding is not sanitization and does not make untrusted markup safe to render elsewhere.
How to use the HTML entity encoder and decoder
- 1
Choose HTML Entity Encode or HTML Entity Decode.
- 2
For encoding, select Minimal HTML Escape, Named, Decimal Numeric or Hexadecimal Numeric.
- 3
Paste text or load a local TXT file.
- 4
Process the input and review the plain-text output.
- 5
Copy or download the result only after checking that the selected style fits its destination.
HTML entity encoding example
Minimal encoding turns <p class="note">Tom & Jerry’s</p> into text containing < for the opening angle bracket, " for quotation marks, & for the ampersand and ' for the apostrophe. The browser displays these examples as text rather than executing markup.
Minimal, named and numeric entities
Minimal mode escapes ampersand, less-than, greater-than, double quote and apostrophe. Named mode prefers standard named references such as & and uses numeric fallback when needed. Decimal mode encodes Unicode code points with decimal references, while Hexadecimal mode uses hexadecimal references.
How decoding works
Decode mode interprets one layer of HTML character references using HTML text-context rules. It handles standard named references, numeric references, legacy semicolon-less cases and numeric replacement rules. Unknown references remain literal. Decoding once means text that was encoded twice may still contain entities after one operation.
Encoding is not sanitization
Entity encoding can make characters suitable for a particular HTML text context, but context matters. HTML attributes, URLs, JavaScript and CSS have different escaping requirements. Decoding untrusted input can reveal markup or script text. This tool keeps that result inert, but copying it into a page with unsafe innerHTML can create security risk.
Important technical limitations
- Plain text only: output is not rendered as HTML and the tool has no preview mode.
- One-level decode: repeated encoding requires separate decode operations.
- Input limit: UTF-8 input is limited to 1 MB.
- Unicode validation: malformed Unicode is rejected during encoding.
- Context: use a trusted context-aware escaping library when generating an application interface.
Related tools
HTML Entity Encoder & Decoder FAQ
What does HTML entity encoding do?
It replaces characters with references that can be represented safely in an appropriate HTML text context.
Which characters does Minimal HTML Escape encode?
It encodes ampersand, less-than, greater-than, double quote and apostrophe.
What is the difference between named and numeric entities?
Named entities use labels such as amp, while numeric entities identify Unicode code points in decimal or hexadecimal.
Does decoding render HTML?
No. Decoded output remains in an inert plain-text field.
Is HTML entity encoding the same as sanitization?
No. Correct handling depends on the output context and untrusted content may still be dangerous elsewhere.
Why do some entities remain after decoding?
The tool decodes one level; input that was encoded more than once can require another operation.
Explore the complete Shopshubb Tools directory or return to Developer Tools.