HTML Entities
Encode or decode HTML special characters.
How to use HTML Entities
Encode text to HTML entities or decode entities back to characters.
Open HTML Entities on toolpermarket, then enter the values you want to work with.
In the Input field, type or paste the text or HTML to encode or decode. Toggle between Encode and Decode for the direction you need.
In the Mode field, choose encode to escape special characters or decode to restore them. Encode user content before injecting it into a page to avoid broken markup.
Press Encode to compute the result. The output appears immediately below the form. Tweak any field and run it again to check a different scenario.
Read the result and use it as needed. If the number looks off, re-check your inputs and run it again — the math is deterministic, so the same entries always return the same answer.
Worked example. Encoding <b>hi</b> & "yes" returns <b>hi</b> & "yes", safe to embed as text.
Tips for accurate results.
Encode untrusted input before rendering it as HTML.
Decode legacy entities when migrating old content.
Prefer named entities like & for readability.
When to use HTML Entities. Escaping user text so it displays instead of executing. Cleaning pasted rich text into safe markup. Understanding why a character showed as a code like
When you actually reach for this
- You are inserting untrusted text into HTML and must escape <, >, &, and quotes so it cannot break markup or inject a tag.
- You received HTML with & " ' and want to turn it back into readable text for display or processing.
Where this tool stops being accurate
- Escaping alone does not make input safe inside an attribute context unless you also quote the attribute and handle event handlers.
- Numeric entities like 😀 decode to the same character as a named one; pick one style for consistency but know both exist.
Frequently asked questions
Why would I encode HTML entities at all?
If you place a literal < or & from user input into a page, the browser may interpret it as markup and break layout or open an injection hole. Encoding turns those characters into harmless named references like < and & that display as the original symbol but are never executed as tags.
Named or numeric entity — which should I use?
Named entities such as © are more readable for common symbols, while numeric ones like © work for any code point and are safest when a named alias is unclear. Both decode to the same character; pick named for the frequent ones and numeric for anything obscure.
Does decoding untrusted text make it safe?
Decoding only reverses the escaping; it does not sanitize. If you decode attacker-controlled text and then inject it, you still risk markup or script injection. Encode on output for display, and separately sanitize on input if the content will ever be treated as HTML.
Do I need to encode every special character or just the dangerous ones?
At minimum escape &, <, >, and quotes in attribute values. Encoding every non-ASCII character is safer for legacy systems but usually unnecessary for UTF-8 pages.
Why did my & turn back into & but &unknown; stayed literal?
Only recognized named entities decode; unknown ones are left as-is by spec-compliant parsers, which is why you should validate entities you generate.