HTML Entity Encoder & Decoder

An HTML document is text that a browser reads as markup, and the moment your content contains a character the parser treats as structure, the two collide. Only five characters carry structural meaning inside HTML: the ampersand & (code point 38, hex 0x26), the less-than sign < (60, 0x3C), the greater-than sign > (62, 0x3E), the double quote " (34, 0x22), and the single quote or apostrophe ' (39, 0x27). Encoding replaces each of these with an escape sequence so the browser prints the character instead of acting on it. This tool encodes those five in one direction and, going the other way, decodes any HTML entity — named, decimal, or hexadecimal — back to the character it stands for.

Every escape sequence comes in three interchangeable forms. A named reference is a mnemonic like &amp; or &lt;, bracketed by an ampersand and a required semicolon; HTML5 defines 2,231 of them, from the everyday &nbsp; (160) to the 31-character &CounterClockwiseContourIntegral;. A decimal reference is &# followed by the Unicode code point in base 10, so & is &#38;. A hexadecimal reference is &#x followed by the same code point in base 16, so & is &#x26;. All three resolve to the identical character; named forms read better, while numeric forms can express any of the roughly 1,114,112 Unicode code points even when no name exists.

The decoder here handles all three because it hands the string to the browser's own parser rather than a partial lookup table. It assigns your text to the innerHTML of an off-screen textarea and reads back its value. A textarea parses its content as raw character data, which means entity references are resolved but tags are never turned into live elements — a decoded <script> stays inert text, so the operation cannot execute anything. It is the same engine the browser uses for real pages, so it recognizes all 2,231 named references and every numeric one without a bundled dictionary that could fall out of date.

HTML entity encoding is the correct defense for exactly one context: HTML text and attribute values. It is not a universal sanitizer. A value placed inside a URL needs percent-encoding, a value inside a <script> block or an inline event handler needs JavaScript string escaping, and a value inside a style rule needs CSS escaping — entity-encoding an attacker's payload in the wrong context can still leave a hole. Real applications should lean on their framework's context-aware auto-escaping — React, Angular, and modern template engines do this by default — and treat a standalone encoder like this one as a way to inspect, learn, and hand-fix a specific string, not as the whole of output safety.