HTML Entities Encode & Decode Online — Escape & Unescape Text
Turn raw characters into HTML/XML entities (and back). Essential before interpolating user content into markup or debugging escaped payloads. Options cover quote escaping when you paste strings into attributes.
What happens during encode vs decode
Encode scans your text left-to-right and replaces structural characters with predefined entities such as &, <, and optional "/' pairs. Decode expands decimal {, hexadecimal {, and common named entities back into literal Unicode characters — iterating until nested sequences like &lt; stabilise. Decode ignores your quote switches because entities already encode quoting intent.
Quote escaping switches
Enable double-quote encoding when embedding values inside double-quoted HTML attributes or JSON-ish snippets. Enable apostrophe encoding when wrapping strings inside single-quoted attributes — frequent in legacy PHP templates. Always complement browser-side helpers with strict server sanitisation before persistence.
Examples
Attribute-ready snippet
Original
Escaped
Decode numeric entities
Original
Escaped
Keep workflows cohesive
Large markup payloads belong in the HTML minifier. Inline scripts benefit from JavaScript compression, and structured feeds pair nicely with JSON formatting.
HTML entities FAQ
Prevent markup breakage while retaining readability
Does escaping replace server-side sanitisation?
Never treat client utilities as authoritative — always validate on the server with frameworks such as DOMPurify equivalents.
Which entities are decoded?
Numeric decimal/hex forms plus frequently used named entities like nbsp, quot, amp, copy, mdash.
Why escape apostrophes?
Single-quoted attributes terminate early if apostrophes remain literal — ' avoids parser surprises.
Will decode strip legitimate ampersands?
Well-formed entities expand; stray ampersands remain untouched unless part of valid sequences.
Is processing private?
Yes — everything stays inside your browser session.
Does encode mode escape every special HTML character?
Always for &, <, and >; quote switches add " or ' when you paste into attributes. Other characters stay literal unless already written as entities.
Can I paste this output straight into React or JSX?
Treat this as a helper for samples. Frameworks already escape text nodes—follow React/Vue/Svelte guidance instead of relying on manual escapes alone.
How is this different from the URL encoder?
HTML entities make text safe inside markup; percent-encoding prepares strings for URLs. Use URL encode for query strings, then entities for HTML context.
Encoding
Encode or decode Base64, URL components and HTML entities — client-side only.
Explore other tool categories
Minify
Shrink code and assets for production — minify JavaScript, CSS, HTML, JSON and XML before gzip or CDN deploy.
Beautify
Make code readable with consistent indentation — beautify JavaScript, CSS, TypeScript, SCSS, LESS, Markdown, GraphQL, SQL, YAML and more in your browser.
Unminify
Expand minified or compressed code — unminify JavaScript, CSS, TypeScript, SCSS, LESS, SQL, YAML and other formats when debugging or reviewing.
Conversion
Transform data between JSON, YAML, XML and CSV locally — no server uploads.
CSS preprocessors
Compile SCSS or LESS to standard CSS in the browser — pair with beautify or minify for a full stylesheet workflow.
JSON Tools
Validate, format, diff and explore JSON payloads — complementary to minifiers and converters.
SVG Tools
Preview, optimize with SVGO, export Data URI, resize, beautify, convert to JSX and validate SVG — all in your browser.
DevOps & Infra
Terraform HCL format/validate/minify, Dockerfile format & lint, Docker Compose and .env validation.
CI/CD
GitHub Actions and GitLab CI — format YAML and check workflow/job structure in your browser.
Logs & observability
Line-oriented JSON/NDJSON and Nginx/Apache access logs — format, filter, validate, and CSV/TSV.
Kubernetes
Multi-doc manifests, structural validate, Ingress/Deployment starters, and Helm values formatting.
Networking / IP
CIDR, subnets, and IPv4/IPv6 helpers — in your browser.
Security & tokens
JWKS, X.509 certificates, and secrets scan — browser-local.
API & schemas
OpenAPI tools to format, validate, and lint your specs.
Developer utilities
Timestamps, UUID, ULID, Nanoid, cron, passwords, regex, slugify, number bases, case, text diff, and chmod — all client-side.
Text & Markdown
Count words, build Markdown TOCs, and clean line lists — all in your browser.
AI & LLM
Token counting, pricing estimates, and context-window fit — 100% browser-local.
Serialization
Serialize and deserialize PHP data structures beside JSON workflows.