Free HTML Entity Encoder & Decoder

1. What HTML Entities Are

HTML entities are escape sequences representing characters that have reserved meaning in HTML markup: the less-than, greater-than, ampersand, double-quote, and single-quote characters. Each entity begins with an ampersand and ends with a semicolon. The five named entities that cover those reserved characters are lt for less-than, gt for greater-than, amp for ampersand, quot for double-quote, and apos for single-quote. Numeric character references use a leading hash and either a decimal or hexadecimal code point, so any Unicode character can be expressed without naming it.

Encoding becomes necessary whenever you want to display, rather than interpret, one of those reserved characters. Without encoding the less-than character, a browser parses it as the start of an HTML tag and your page layout breaks. Worse, an attacker who smuggles unencoded less-than plus following markup into a comment or profile field runs arbitrary script on victim browsers. Encoding literal reserved characters before they reach the renderer is one of the basic building blocks of safe web development.

2. When to Encode, When to Decode

Encode when you authored plain text and you want to display it safely on a web page. Decode when you scraped HTML and need the original text. Encoding is also the correct move when you generate HTML programmatically and concatenate user input anywhere in the markup; encoding the user input before you embed it prevents script injection. Decode is the right move when you are extracting headlines and article text from crawled HTML so a downstream analytics pipeline can count words without HTML entities in the way.

A surprising number of edge cases appear at attribute boundaries. Inside a double-quoted attribute, an unencoded double-quote terminates the attribute early and breaks the markup. Inside a single-quoted attribute, the single-quote does the same. Encoding both quote variants is the safest default; the cost is a few extra bytes per occurrence and the win is a markup file that survives attribute concatenation in any framework.

3. Named Entities Versus Numeric Character References

Named entities are short and human-readable: amp, lt, gt, quot, apos, plus non-breaking space nbsp and a handful of others. Numeric character references use a hash and a code point (decimal or hex) to address any Unicode character, including those without a named entity. Use named entities for the reserved five because they are more readable in source; use numeric references when you need to express a character that lacks a name or when you want a completely character-driven workflow.

4. Bidirectional Conversions and Common Pitfalls

The ToolWise HTML Entity Encoder and Decoder supports bidirectional conversion. Encode takes plain text and outputs the entity-escaped version. Decode takes entity-encoded text and outputs plain text, recognizing every common named entity plus numeric references in both decimal and hexadecimal form. One common pitfall is decoding the same content twice: an encoded amp already renders as the literal ampersand character and round-trips cleanly, but if your pipeline decodes twice the first pass produces the ampersand and a second pass leaves the bare character without re-encoding protection. Treat each decode as a one-step operation.