Encode and decode HTML entities in your browser
Escaping user input is the difference between rendering a name and executing a script. This tool converts text to HTML entities and back again, covering named entities, decimal references and hexadecimal code points.
- Named entities
- HTML5 set
- Numeric refs
- Decimal + hex
- Direction
- Encode / decode
How to use it
- Paste the text Paste raw text to escape it, or paste a fragment containing & and © to decode it. The mode toggle switches between the two.
- Choose the scope Escape everything including quotes and slashes for maximum safety, or escape only the characters that break out of HTML text content.
- Copy the escaped result The output contains only the characters you need, so it can be dropped into an attribute, a text node or a JavaScript string.
Questions people ask
Which characters need escaping?
In HTML text content, the ampersand, the less-than sign and the greater-than sign matter. Inside an attribute value you also need to escape double quotes. The strict mode escapes all of those plus the single quote and the slash.
What is the difference between & and &?
They mean the same thing. The named form & is more readable, the numeric form & is shorter and is the only portable option in XML.
Does the decoder handle numeric references?
Yes. Both decimal references such as `—` and hexadecimal references such as `—` are decoded, along with the named HTML5 entities.
Will decoding fix broken HTML?
No. It converts entity references back into characters. It does not repair unbalanced tags, and it cannot recover text that was already mangled before it reached you.
Should I escape the ampersand in a URL?
Inside HTML text, yes — a bare ampersand in a query string is invalid HTML even though browsers tolerate it. Inside a URL, the ampersand is usually correct as-is; encode it as %26 only when it is part of a parameter value.
Does this tool protect against XSS on its own?
Escaping is one layer, not the whole defence. Output encoding matters, but so do a strict Content Security Policy, avoiding unsafe DOM APIs such as innerHTML on untrusted strings, and validating URLs before you put them in an href.
Details that catch people out
Storing pre-escaped data means you have to guess at every future context it might be rendered in. Escaping at the point where the value enters the HTML means each context can decide for itself — and you stop double-escaping existing entities.
Where this earns its keep
Storing user input safely
Before a comment or a display name is written into a page, escaping it removes any possibility that the value is interpreted as markup. Escape at the point of output, not at the point of input.
Cleaning up scraped content
Text pulled from an old site or a CMS export is often full of entities. Decoding first makes it searchable and comparable with plain-text sources.
Preparing content for an XML document
XML only recognises five named entities, so numeric references are the portable choice when a value contains an ampersand, a less-than sign or a quote.
Last reviewed 2026-09-22. Every tool on DevSnap runs entirely in your browser, so whatever you paste here never reaches a server.