Which preset should I use?

Minimal for text inside elements, Attribute-safe for values inside attributes (it also covers ` and =), All non-ASCII when the file must stay pure ASCII, and Everything for obfuscation or to reveal invisible characters.

Are named entities like © supported?

Yes. Decoding knows every HTML5 named reference (2,125 names) plus decimal and hex numeric references. Encoding uses the classic HTML 4 names by default and can use the full HTML5 set.

What happens to &copy without a semicolon?

Browsers decode a small legacy set without the semicolon, and so does this tool — with a warning, because inside attributes that decoding does not happen. Always write the semicolon.

Why did become an en dash?

Numeric references in the range 128–159 are C1 control codes, and the HTML spec remaps them to Windows-1252 characters. The tool does the same and tells you the correct code point (–).

Is encoding alone enough to prevent XSS?

It is necessary but not sufficient. Context matters — URLs, JavaScript strings and CSS need their own escaping rules, and attribute values must be quoted.

HTML Entity Encode / Decode

Encode special characters into HTML entities or decode entities back to text. Encoding presets cover the five markup-breaking characters, attribute-safe escaping, text-node escaping, every non-ASCII character, or everything; the entity style (named, decimal, hex) applies consistently, and existing entities are preserved so nothing is double-encoded. Decoding follows the HTML5 parser: all 2,125 named references, decimal and hex numeric references, legacy names without a semicolon and the Windows-1252 remap, with unknown or invalid references reported. A sanitised live preview shows how the output renders.

Runs locally in your browser

Paste a whole template, or open fullscreen for more room

Text or HTML

0 chars · 1 line

Encoded (Minimal, named)

Output will appear here…

Rendered outputEntities show as literal text. Scripts, event handlers and iframes are stripped by DOMPurify.

Nothing to render yet.

Preset

Style

The five characters that can break markup: & < > " '. What most template engines escape by default. Characters without a name fall back to a hex reference.

Keep existing entities (no double-encoding)HTML 4 names only (else all 2,125 HTML5 names)Per-line batch

URL Encode / Decode

Percent-encode text with encodeURIComponent, encodeURI, form or RFC 3986 rules, decode multi-layer strings, and edit query strings in a table.

String Escape / Unescape

Escape or unescape strings for JSON, JS, HTML, XML, URL, regex, shell, CSV, SQL, Python, Java, C#, Go, YAML and .properties.

Unicode Escape / Unescape

Convert text to \uXXXX, \u{…}, \x, U+, &#x…;, Python, Go or CSS escapes and back, and inspect every code point for invisible or look-alike characters.

HTML / CSS Prettifier

Beautify or minify HTML, CSS, SCSS, Less, JS, TS, JSON, YAML, Markdown and more — with preview and lint.

How to use HTML Entity Encode / Decode

1Pick Encode or Decode and paste your text or HTML — the output updates as you type.
2When encoding, choose a preset: Minimal (& < > " '), Attribute-safe, Text node, All non-ASCII or Everything, and pick named, decimal or hex references.
4When decoding, read the notices: unknown names, out-of-range numbers, legacy references without a semicolon and C1 remaps are all listed with the exact reference.
5Check the rendered preview (sanitised with DOMPurify) to see how a browser would display the output, then copy or download.

About HTML Entity Encode / Decode

HTML Entity Encode / Decode is part of FizzKit — a collection of focused developer and ad-tech tools. Because everything runs locally, it works offline once loaded and never exposes your data to a remote server.

Frequently asked questions

Whenever untrusted text is rendered into HTML. Encoding & < > " and ' neutralises tags and attribute break-outs, which is the first line of defence against XSS.

Related tools