Encode or decode HTML entities
Escape characters that browsers interpret as HTML, or restore named and numeric entities to readable text.
Ready when you are.
Your input stays in this tab. DevBox does not upload or save it.
Escape HTML-sensitive text
Choose Encode to replace ampersands, angle brackets and quotes with entity references. Choose Decode to restore supported named entities and valid decimal or hexadecimal numeric entities.
Entity encoding is a representation tool, not a complete sanitizer. If untrusted input can contain markup, use a maintained sanitizer designed for the exact browser context where the value will be inserted.
HTML entity questions
What are HTML entities?
HTML entities are text representations of characters that would otherwise be interpreted as markup. For example, < represents a less-than sign and & represents an ampersand.
Which characters does this tool encode?
It encodes ampersand, less-than, greater-than, double quote and single quote. These are the five characters most often escaped in HTML text and attribute values.
Does HTML entity encoding sanitize untrusted HTML?
No. Encoding text can help when placing plain text into a correctly chosen HTML context, but complete cross-site-scripting protection requires context-aware escaping and a trusted sanitization library.
Can it decode numeric entities?
Yes. DevBox decodes decimal entities such as © and hexadecimal entities such as 🚀 when they represent a valid Unicode code point.