HTML Entity Encoder / Decoder

Q: My text is full of &lt; instead of <. What happened?

It was encoded twice, usually by an application that escaped text which had already been escaped. Paste it in with multi-pass decoding on and each pass strips one layer, up to five, with a counter showing how many layers there were. To avoid causing it yourself, turn on "Skip existing entities" when encoding text that already contains references — without it, the notes panel warns you that the output is double-encoded.

Q: Can it handle emoji and characters that have no named entity?

Yes. The encoder walks your text by code point rather than by UTF-16 unit, so an emoji becomes a single reference such as 😀 instead of two broken halves. The named table covers the complete HTML 4.01 set plus 38 HTML5 additions; any character without a name there is written as a numeric reference, which every browser and XML parser understands. When decoding, a name outside the table is listed in the notes panel and left exactly as you pasted it.

Q: Is any of my text sent to a server?

No. Encoding and decoding are string operations running in the page you are looking at, files you drop are read with the browser file reader, and downloads are generated in memory. Nothing is transmitted, which also means the tool keeps working offline once the page has loaded.

Encode and decode HTML entities and special characters

Written by toolforge.websiteLast reviewed 23 August 2026How we build and check these tools

HTML Entity Encoder / Decoder: key facts

What it does: Encode and decode HTML entities and special characters
Category: Developer Tools
Cost: Free, with no account, sign-up, or install.
Your data: Runs entirely in your browser — the files and text you enter are never uploaded to a server.
Last reviewed: 23 August 2026. Report an incorrect result.

What the HTML Entity Encoder / Decoder does

An ampersand in a product title, a straight quote inside an alt attribute, an em dash pasted out of Word — any one of them can turn working markup into a rendering bug or an injection hole. This tool rewrites those characters as HTML entity references and turns references back into characters, with control over how much gets escaped and which form the references take.

What needs escaping depends entirely on where the text is going, so the tool exposes that instead of guessing. Body copy in a UTF-8 page only needs the ampersand and the angle brackets handled. A string destined for a title attribute needs both quote characters and its line breaks escaped as well, or the attribute ends early. XML defines only five named entities, so in an XML document everything else has to be numeric. A legacy email template may need every character above U+007F converted. Five presets cover those cases, and each individual switch behind them stays adjustable — output form, quote handling, non-ASCII, tabs, line breaks, double spaces, and whether references already in the text are left alone.

Decoding runs the other way against the same 290-name table: named references, decimal ones like ©, hexadecimal ones like ©, names written without their closing semicolon, and the Windows-1252 quirk that makes browsers show  as a curly quote. Multi-pass decoding unwraps text that was encoded twice, so &lt;div&gt; resolves all the way to a literal tag instead of stopping at <div>. Anything the table does not recognise is reported and passed through untouched rather than silently dropped.

Using the HTML Entity Encoder / Decoder, step by step

Type, paste, or drag a text file into the input panel. Files up to 2 MB are read locally.
Leave Direction on Auto and the tool decodes when it finds references that resolve and encodes when it does not — or pin it to Encode or Decode yourself.
When encoding, pick the preset that matches where the text is going: HTML text, HTML attribute, XML / XHTML, ASCII-only, or Maximum. Switch the output form to decimal or hex, or open Advanced for the individual controls.
Read the counters under each panel — characters, code points, UTF-8 bytes, how many characters were escaped or references resolved, and the size difference — then check the notes panel for double-encoded input, unknown names, or malformed numeric references.
Copy the result, download it as a text file, or press Swap to move it into the input and convert back the other way.
Open the Reference tab to search all 290 entities by name, description, character, or code point, copy any of the three forms, or insert the character straight into your input.

What makes this one worth using

Escaping is configurable rather than fixed: named references with a numeric fallback, pure decimal, or pure hex; quotes on or off; non-ASCII on or off; and an XML mode that emits only the five names XML actually defines so the output still parses.
Decoding is plain string replacement against a lookup table. Your input is never assigned into the page, so a pasted image or iframe tag cannot fire a handler or fetch a remote file — it is treated as ordinary text, exactly like every other character.
Multi-pass decoding fixes the double-encoding that turns up in CMS exports and log files, and the encoder warns you before it creates that problem in the first place, with a switch to pass existing references through instead.
A scan flags invisible and confusable characters the text picked up along the way — no-break spaces, soft hyphens, zero-width joiners, bidirectional controls, byte-order marks — with a count and the reference to copy for each one.
The character inspector lists every distinct special character in your text with its description, code point, occurrence count, and each reference form available for it, so a mystery character in a paste becomes an identified one.

Frequently Asked Questions

Why are accented letters left alone when I encode?

Because a UTF-8 page renders them correctly as they are, and escaping them only makes the source harder to read and the file bigger. Turn on "Escape non-ASCII" — or choose the ASCII-only preset — when the destination genuinely cannot carry them: an old email template, a system limited to ASCII, or a database column with a single-byte encoding.

Should I use named, decimal, or hexadecimal references?

Named references are the most readable and are what you want in ordinary HTML. Decimal and hexadecimal work for any code point, including the thousands of characters that have no name at all, and hexadecimal matches how code points are written in specifications. In XML only lt, gt, amp, quot and apos are defined, so the XML preset switches everything else to numeric. One deliberate exception: the apostrophe encodes as ' by default, because ' is absent from HTML 4 and older browsers — there is an Advanced switch if you want the name instead.

My text is full of &lt; instead of <. What happened?

It was encoded twice, usually by an application that escaped text which had already been escaped. Paste it in with multi-pass decoding on and each pass strips one layer, up to five, with a counter showing how many layers there were. To avoid causing it yourself, turn on "Skip existing entities" when encoding text that already contains references — without it, the notes panel warns you that the output is double-encoded.

Can it handle emoji and characters that have no named entity?

Yes. The encoder walks your text by code point rather than by UTF-16 unit, so an emoji becomes a single reference such as 😀 instead of two broken halves. The named table covers the complete HTML 4.01 set plus 38 HTML5 additions; any character without a name there is written as a numeric reference, which every browser and XML parser understands. When decoding, a name outside the table is listed in the notes panel and left exactly as you pasted it.

Is any of my text sent to a server?

No. Encoding and decoding are string operations running in the page you are looking at, files you drop are read with the browser file reader, and downloads are generated in memory. Nothing is transmitted, which also means the tool keeps working offline once the page has loaded.