Encode special characters and reserved symbols into safe HTML entities, or decode entity references back to readable text with bidirectional swapping.
Converted output will appear here...
Safely render reserved markup characters, prevent XSS vulnerabilities, and parse raw entities.
In HTML, characters like <, >, &, and quotes are reserved syntax tokens used to define tags and attributes. If you want these characters to display as literal text on a webpage rather than being interpreted as code, they must be converted into their respective HTML character entities.
The Developers Web Tools HTML Entity Encoder / Decoder converts raw text and special characters into named (e.g. &), decimal (e.g. &), or hexadecimal (e.g. &) entities, or decodes messy entity-encoded strings back into readable text entirely within your browser.
Understanding named, decimal, and hexadecimal character representations in HTML5.
&, <, ©)Human-readable entity names for common characters like ampersands, angle brackets, quotes, and international currency or copyright symbols.
<, >)Unicode code points expressed in base-10 decimal format, universally supported across all browsers, XML parsers, and email clients.
<, >)Unicode code points in base-16 hex format, ideal for security sanitization, escaping inline script payloads, and international typography.
Engineered for fast, reliable, and secure character transformation.
Clicking ⇄ Swap places the current converted output text into the input field and automatically switches between Encode and Decode modes so you can reverse conversions instantly.
The five primary characters reserved by HTML syntax are: & (&), < (<), > (>), " ("), and ' (').
Named entities use descriptive abbreviations (e.g. © for ©), while decimal entities reference the character's exact Unicode number (e.g. ©). Both render identically in web browsers.
Yes! Decoding utilizes the browser's native DOM parser, supporting all standard HTML4, HTML5, mathematical, Greek, and typographic entities.
No. All encoding, decoding, and swapping operations run 100% locally in your browser through client-side JavaScript. Your text remains private.