HTML Entity Encoder / Decoder

How It Works

HTML entities are special codes that represent characters which either have special meaning in HTML markup or cannot be typed directly. The most critical ones are & for the ampersand (&), < for less-than (<), and > for greater-than (>). Failing to encode these when inserting user-supplied data into HTML is a primary cause of Cross-Site Scripting (XSS) attacks.

There are three entity formats. Named entities like © are human-readable and widely supported. Decimal entities like © use the character's Unicode code point in base-10. Hexadecimal entities like © use base-16. All three formats decode to identical characters — choose whichever fits your context.

The Encode all characters option converts every character, including plain ASCII letters and digits, to its entity form. This is useful for email address obfuscation (hiding addresses from scrapers) or encoding text for contexts where only entity form is safe.

Decoding uses the browser's built-in DOMParser API, which handles all named, decimal, and hexadecimal entities correctly — including edge cases like   (non-breaking space) and multi-byte Unicode characters.