HTML Encode and Decode

What HTML encoding does

Some characters have special meaning in HTML. A < starts a tag, & starts an entity, and quotes end attribute values. To show those characters as text, they must be written as HTML entities: <, &, " and so on. This is called HTML encoding or escaping.

Use the encoder to show code examples in a blog post, put user-supplied text into HTML safely, or prepare text for systems that only accept ASCII.

Encoding options

• Only < > & " ': the minimum needed for safe HTML. Everything else, including accented letters and emoji, stays readable. This is right for almost every modern UTF-8 page.
• Also every non-ASCII character: converts characters like é, £ and emoji to entities, for old systems, email templates or files that are not saved as UTF-8.
• Every character: encodes even letters and digits. Occasionally used to make text harder for simple scrapers to read, for example an email address on a contact page.

Entity style controls the output: named entities like é are easiest to read, and characters without a common name fall back to numbers. Decimal and hex work for every Unicode character.

Decode HTML entities and strip tags

HTML decode turns entities back into characters. It handles every named entity in the HTML standard, plus decimal and hex numeric entities. Use it when text from a database, an RSS feed, an API or a CMS export shows & or ’ instead of real characters, which usually means it was encoded twice. Run it again if one pass is not enough.

Strip HTML tags converts HTML into plain text. Scripts, styles and hidden templates are removed, entities are decoded, and paragraph and line breaks are kept so the text stays readable. Tick Keep link URLs in brackets to preserve where links pointed. It is useful for word counts, plain text emails, meta descriptions and moving content between systems.

HTML encoding and XSS

Cross-site scripting (XSS) happens when a site puts untrusted text into a page without encoding it, letting an attacker inject <script> tags or event handlers. The fix in application code is to encode output for the context it goes into: HTML encoding for page content and attributes, URL encoding for URLs, and JavaScript escaping inside scripts. Frameworks such as Laravel Blade ({{ }}), Twig and React do this automatically, and in plain PHP use htmlspecialchars($text, ENT_QUOTES, 'UTF-8').

This tool is for one-off conversions and checking output. It runs in your browser and never sends your content anywhere. For URLs use the URL encoder, for binary data use the Base64 encoder, and to check a whole page for markup problems use the HTML validator.

HTML encode and decode examples

Encoding the text

<p>Fish & chips cost £5 "today"</p>

with the default options gives

<p>Fish & chips cost £5 "today"</p>

which a browser displays exactly as the original text, tags and all, instead of rendering a paragraph. Choosing Also every non-ASCII character additionally turns £ into £ (named) or £ (decimal).

Decoding works the other way. A common real-world example is text from a WordPress database or an RSS feed such as Rock & Roll – It’s back, which decodes to Rock & Roll – It’s back with a proper dash and curly apostrophe.

Encoding is context-specific. HTML entities are right inside page content and attribute values, but not inside URLs, where you need percent-encoding, or inside JavaScript strings, where you need backslash escapes. Mixing them up produces visible codes like %20 or & on the page, or broken links. When text looks wrong, work out which encoding was applied, and in which order, before decoding.

HTML Encode / Decode: frequently asked questions