Updated · Built and checked by the PlinzoTools team, formulas tested against published sources
Escape text into safe HTML entities, or decode entities back to plain text.
<a href="x">Tom & Jerry's</a>HTML treats a handful of characters specially -- <, >, &, and quote marks -- since they're part of HTML's own syntax. If you paste raw text containing these characters directly into HTML, the browser can misinterpret it as markup instead of content. This tool escapes those characters into their safe HTML entity equivalents (or decodes entities back to plain text), so text displays exactly as intended.
Paste your text, choose Encode or Decode, and the result updates instantly. Encoding is useful before embedding user-generated text into an HTML template; decoding is useful when you have entity-escaped HTML source and want the readable text back.
Encoding replaces 5 characters: & to &, < to <, > to >, " to ", and ' to '. Decoding reverses both named entities (like &) and numeric entities (A or A) back to their actual characters.
For encoding an entire URL rather than HTML text, see the URL Encoder. To validate HTML markup itself, use the HTML Beautifier.
Suppose you want to show the snippet if (a < b && c > d) literally on a web page. If you paste it raw, the browser may treat the less-than sign as the start of a tag. Encoding replaces each special character, so the output becomes if (a < b && c > d), and the browser displays the original text. Going the other way, decoding a string such as Tom & Jerry – Classics returns Tom & Jerry with the character for code point 8211 in the place of the numeric entity. This mirrors how the tool works in each direction.
A very common bug is double encoding. If text has already been encoded and you encode it again, the ampersand of each entity is itself escaped, so &lt; appears instead of the intended less-than sign. On screen, users then see the literal text "<" instead of the symbol. Encode exactly once, at the point where text enters HTML, and decode exactly once if you need plain text back. If you see a string with several stacked layers of ampersand-amp, run Decode more than once to unwind it.
Encoding changes only the five characters covered by the tool. Accented letters, emoji and other non-ASCII characters are left as they are, which is fine when your page is served as UTF-8, the norm today. It does not convert non-breaking spaces or typographic quotes into named entities, and it does not remove tags. If you need to strip markup rather than display it, you need a sanitizer instead of an escape step.
Escaping for HTML body text is different from escaping inside an attribute, a script block, a style block or a URL. The five-character escape suits ordinary text content and quoted attribute values, but it does not protect a value placed into JavaScript or a URL. For production code that handles untrusted input, rely on your framework's built-in escaping and a maintained sanitization library, and use this tool for quick checks, documentation snippets, and inspecting encoded text.
Because HTML parsers treat < as the start of a tag -- unescaped, "5 < 10" could be misread as the beginning of a (nonexistent) tag, breaking the page's rendering.
Escaping the 5 characters here handles the most common case, but full XSS prevention depends on context (HTML body vs. attribute vs. JavaScript) -- use a proper sanitization library for security-critical applications, not just this quick reference tool.
Named entities (like &) are easier to read; numeric entities (& or &) work for any Unicode character, even ones without a defined name.
The text was encoded more than once. Run the decoder again until the visible text stops changing.
No. Only the ampersand, less-than, greater-than, double quote and single quote are changed. Other characters pass through unchanged.
You can, but the tags will show as visible text once displayed. That is useful for showing code examples, not for publishing a working page.
Reference: MDN Web Docs