HTML Encode / Decode

How do I HTML-encode text?

Result

Tom & Jerry <3 it

How it is calculated

In encode mode the tool escapes the HTML special characters as UTF-8 text, quotes of both kinds included. It replaces five characters: & becomes &amp;, < becomes &lt;, > becomes &gt;, a double quote becomes &quot; and a single quote becomes &#039;. Every other character, including letters with accents, is left untouched.

Decode mode reverses this: it first undoes those five replacements and then converts any other named or numeric entity (such as &eacute; or &#169;) to its character. Empty input gives no result.

Worked example

Encode the text Tom & Jerry <3 it. Scanning left to right, the first special character is the ampersand, which becomes &amp;. The less-than sign in <3 becomes &lt;. Letters, digits and spaces stay as they are. The result is Tom &amp; Jerry &lt;3 it.

Try this example →

Common mistakes

  • Encoding the same text twice. The ampersand in an existing &amp; is encoded again and the page then shows the literal text &amp;.
  • Expecting encoding to make text safe in every context. It protects HTML text and quoted attributes, but not text placed inside JavaScript, CSS or URLs.
  • Pasting already-encoded text into decode mode twice, which can turn a deliberate &lt; into a real tag character.
  • Assuming accented letters or emoji get entities. They are left as they are, so the page must be served as UTF-8.

About this calculator

This tool converts special characters like <, >, & and quotes into their HTML entity equivalents (&lt;, &gt;, &amp; and so on), or reverses the process to decode entities back into readable text. Without encoding, a character like < in user-supplied text gets interpreted by the browser as the start of an HTML tag instead of being displayed literally, which can break page layout or open the door to script injection.

Web developers use it when embedding raw text — code snippets, user comments, or content pulled from another source — into an HTML page safely, and when debugging why a page is rendering a stray tag instead of the literal character it was supposed to show. It's also used in reverse, to decode entity-laden text copied from a webpage's source back into plain, readable text.

Was this helpful?

You can pick up to 3 reactions.

Comments (1)

  • Editorial team

    Only five characters are touched when encoding: ampersand, less-than, greater-than, and both kinds of quote. Accented letters and other non-ASCII text stay as typed, so the output is safe for showing code inside a page but is not a full named-entity conversion. Decoding goes further and turns any named or numeric entity back into its character. Encode once only, since running the output through again doubles every ampersand. Which entities do you need beyond these five?

Popular calculators

All Calculators