HTML Encoder & Decoder
Encode special characters to HTML entities, decode entities back to characters, or strip all HTML tags. Supports 5 encoding modes — essential XSS-safe, named, decimal, hex, and attribute-safe. Free, instant, nothing uploaded.
&&&<<<>>>"""'''©©©®®®™™™€€€£££¥¥¥———–––………   «««»»»×××÷÷÷±±±∞∞∞≠≠≠≤≤≤≥≥≥<→<×9>→>×9"→"×7&→&×3'→'Free HTML Encoder & Decoder — All Modes, Instant Results
This free HTML encoder and decoder converts special characters to HTML entities and back, with five encoding modes (essential XSS-safe, named entities, decimal numeric, hex numeric, and attribute-safe), tag stripping, entity analysis, a complete reference table, and language equivalents for PHP, Python, JavaScript, Go, Java, Ruby, C#, and Rust. All processing runs locally — nothing uploaded.
What This Tool Does
- HTML encode — Convert & < > " and other special characters to safe HTML entities. Five encoding modes for different use cases.
- HTML decode — Convert < & © and any named, decimal, or hex entity back to its character.
- Strip HTML tags — Remove all HTML markup and <script>/<style> blocks, leaving plain text.
- Named entities — © € — for readable, compact HTML source.
- Decimal entities — © € for maximum browser and email client compatibility.
- Hex entities — © € for XML and technical contexts.
- Attribute-safe encoding — Encodes all characters that could break HTML attribute values.
- Non-ASCII only mode — Encodes only high Unicode characters, leaving ASCII intact.
- Entity analysis — Shows every entity type found in the encoded output with decoded value and count.
- Rendered preview — See how the browser renders the encoded/decoded HTML.
- Quick reference bar — 24 most common entities with named, decimal, and hex codes side by side.
Frequently Asked Questions
What is HTML encoding and why is it needed?
HTML encoding converts characters that have special meaning in HTML into safe entity representations. For example, < becomes < and & becomes &. This is essential to: (1) prevent XSS attacks when rendering user input in HTML, (2) display characters that would otherwise be interpreted as HTML markup, and (3) support special characters in legacy environments that may not handle UTF-8 correctly.
What is the difference between HTML encoding and URL encoding?
HTML encoding converts characters to HTML entities (< &) for use inside HTML documents. URL encoding (percent-encoding) converts characters to %XX format for use in URLs. A URL inside an HTML attribute needs both: URL-encode the URL first, then HTML-encode the result into the attribute value.
Which characters must always be HTML encoded?
The five essential characters: & (ampersand → &), < (less-than → <), > (greater-than → >), " (double quote → "), and ' (single quote → '). Always encode & first — encoding other characters first can cause double-encoding of the ampersand in their entity names.
What is and when do I use it?
(decimal  ) is a non-breaking space. It prevents line breaks between words and is not collapsed by HTML (regular spaces between words are collapsed to one). Use it to: prevent wrapping (10 km), add horizontal space in HTML, or ensure minimum content in table cells.
How do I HTML encode in JavaScript?
JavaScript has no built-in HTML encoder. The DOM approach: create a text node or set element.textContent (which auto-escapes), then read innerHTML. For Node.js, use the 'he' npm package. Never use string.replace() chains for HTML encoding — they miss edge cases and can be bypassed.
What is the difference between named, decimal, and hex entities?
Named: © € — — human-readable, defined in the HTML spec. Decimal: © € — the Unicode code point as a base-10 number. Hex: © € — the code point in hexadecimal. All three produce identical browser output. Use named for readability, decimal for maximum compatibility, hex for XML or when matching a hex-based workflow.
Is stripping HTML tags the same as sanitizing HTML?
No. Tag stripping is useful for text extraction but is NOT a security sanitization strategy. Attackers can craft inputs that survive naive stripping. For security-critical contexts, use DOMPurify (JavaScript), Bleach (Python), or HTMLPurifier (PHP) — dedicated sanitization libraries that understand the HTML spec and handle edge cases.