Free · without registration
Convert HTML Entities Securely as Text
Convert special characters into HTML character references or read encoded text again in plain text. The result is presented exclusively as text; inserted HTML is not executed.
Code or decode text
Result and next steps
When HTML character references are needed
Certain characters have a syntactic meaning in HTML. If a merchant sign or a pointed bracket appears as text, a character reference may be required. The encoder replaces the HTML special characters &, <, > as well as both quotes. Upon request, umlauts, other writings and emojis are also numerically represented.
Named and numerical spellings
A character can be described by a name or by its Unicode code point. Thus, decimal and hexadecimal references can also be decoded. The output takes place as text in an input field. A decoded string such as a script tag is therefore not inserted as an executable element in the page.
Recognize double coding
An already encoded merchant mark can be given another level by encoding again. The decoder deliberately removes only one level per execution. Therefore, check where your CMS or template already encodes. Multiple automatic decoding could change the meaning of an original literal text.
No universal protection for every context
HTML text, HTML attributes, URLs, JavaScript and CSS require different treatment. This tool is not an HTML sanitizer and does not check whether a link is harmless. In the application code, use the function that matches the output context. For percentage sequences in URLs, the separate URL encoder/decoder is available.
Frequent questions
Is the HTML entered executed?
No. The processing uses a parser without a browser document and shows the result only as text. No images, scripts or links are loaded from the input.
How often is decoded?
Once per execution. A doubly encoded sequence may remain encoded after the first run.
Are Entities Always Required for Umlauts?
No. In HTML delivered correctly as UTF-8, umlaute can stand directly. The numerical output is an optional form of representation.
Is the result automatically safe for JavaScript or URLs?
No. Different rules apply to this. Select the appropriate escaping for the actual context in the respective system.