Which characters does Encode escape?

Exactly five: the ampersand becomes &, the angle brackets become < and >, the double quote becomes " and the apostrophe becomes '. Every other character — letters, digits, accents, emoji — passes through unchanged.

Why does the apostrophe become ' instead of '?

' was never defined in HTML 4, so some old browsers and email renderers display it literally. The numeric reference ' means exactly the same character and works everywhere. The decoder here accepts both spellings.

Does Decode handle every HTML entity?

No — it reverses the five entities this tool produces (&, <, >, ", ') plus '. Other named entities such as or ©, and numeric references other than ' (like ), are left exactly as they are. It is an escaper for markup-significant characters, not a full entity table.

What is double encoding and how do I spot it?

Encoding text that is already encoded: < becomes <, which a browser then displays as the literal text <. Stray fragments like & visible on a page are the tell-tale sign. Encode exactly once, at the moment text is inserted into HTML — or run Decode here repeatedly until the text stops changing to count the layers.

Is HTML encoding enough to prevent XSS?

Escaping these five characters is the standard defence when untrusted text is inserted into element content or quoted attribute values — a pasted script tag arrives as harmless visible text. But every context has its own rules: text placed inside URLs, inline JavaScript or CSS needs that context’s escaping instead (for URLs, see the URL Encode tool). Always escape for the exact place the text lands.

What happens to accented characters and emoji?

Nothing — they are not among the five special characters, so they pass through literally in both directions. On a UTF-8 page that is exactly what you want; converting é to é is unnecessary, and this tool never does it.

No. Encoding and decoding run entirely in your browser as you type — nothing is sent to a server, and the same logic powers the ZoolTools mobile app via shared test vectors.

HTML Encode / Decode

Escape HTML special characters (&, <, >, ", ') or decode entities back to text.

Runs in your browser — files never leave your device

Input

Output

How it works

Switch between Encode and Decode, paste your text, and the result appears as you type. Encode escapes the five characters that carry special meaning in HTML, replacing them with entities: &, <, >, " and '. Decode maps those five back to characters and also accepts '.

Those five are exactly the characters that can change how a browser parses a page: an ampersand starts an entity, angle brackets open and close tags, and quotes end attribute values. Everything else passes through untouched — accented letters and emoji stay literal instead of being turned into references like é, which is the right behavior on UTF-8 pages.

A concrete example: <b>"Fish & Chips"</b> encodes to <b>"Fish & Chips"</b>. Drop that into a page and the browser displays the original text — angle brackets, quotes and all — instead of rendering bold text.

Escaping is how you display code snippets in blog posts and documentation, show user-submitted comments without letting them inject markup (unescaped input containing a script tag is the classic stored-XSS mistake), and embed HTML examples inside other HTML. Decode goes the other way: recovering readable text from scraped pages, RSS feeds or database exports that arrive full of & and '.

The main pitfall is double encoding: running already-encoded text through Encode again turns < into &lt;, which a browser then shows literally — the stray & fragments you sometimes see on broken pages. Encode exactly once, at output time. Note also that the decoder is deliberately narrow: entities outside the set above, such as   or numeric references like  , are left unchanged.

Frequently asked questions

Which characters does Encode escape?: Exactly five: the ampersand becomes &, the angle brackets become < and >, the double quote becomes " and the apostrophe becomes '. Every other character — letters, digits, accents, emoji — passes through unchanged.
Why does the apostrophe become ' instead of '?: ' was never defined in HTML 4, so some old browsers and email renderers display it literally. The numeric reference ' means exactly the same character and works everywhere. The decoder here accepts both spellings.
Does Decode handle every HTML entity?: No — it reverses the five entities this tool produces (&, <, >, ", ') plus '. Other named entities such as   or ©, and numeric references other than ' (like  ), are left exactly as they are. It is an escaper for markup-significant characters, not a full entity table.
What is double encoding and how do I spot it?: Encoding text that is already encoded: < becomes &lt;, which a browser then displays as the literal text <. Stray fragments like &amp; visible on a page are the tell-tale sign. Encode exactly once, at the moment text is inserted into HTML — or run Decode here repeatedly until the text stops changing to count the layers.
Is HTML encoding enough to prevent XSS?: Escaping these five characters is the standard defence when untrusted text is inserted into element content or quoted attribute values — a pasted script tag arrives as harmless visible text. But every context has its own rules: text placed inside URLs, inline JavaScript or CSS needs that context’s escaping instead (for URLs, see the URL Encode tool). Always escape for the exact place the text lands.
What happens to accented characters and emoji?: Nothing — they are not among the five special characters, so they pass through literally in both directions. On a UTF-8 page that is exactly what you want; converting é to é is unnecessary, and this tool never does it.
Is my text uploaded?: No. Encoding and decoding run entirely in your browser as you type — nothing is sent to a server, and the same logic powers the ZoolTools mobile app via shared test vectors.

HTML Encode / Decode

How it works

Frequently asked questions

Related tools