How to use this tool
- Select Escape HTML characters or Decode supported entities.
- Paste the source text, including semicolons on entity references you want decoded.
- Run Convert entities. Copy the result as text; the tool never displays it as executable HTML.
Understanding the output
Encoding replaces ampersand, less-than, greater-than, double quote, and single quote. Decoding supports amp, lt, gt, quot, apos, nbsp, and decimal or hexadecimal numeric references. Unsupported named references remain unchanged so the tool does not silently invent a character.
If the text belongs in a URL value instead of HTML text, use the URL Encoder and Decoder because the escaping rules are different.
Showing markup as text
<b>A & B</b> becomes <b>A & B</b>. Decoding that output once restores the original text string, but does not render a bold element.
Escaping depends on the output context
HTML text, JavaScript strings, CSS values, and URL parameters use different rules. This utility converts a small set of HTML-sensitive characters; it is not a universal sanitizer for every place that accepts user input. In an application, use the framework’s context-appropriate escaping and safe DOM APIs rather than manually assembling markup from untrusted strings.
Decoding can introduce angle brackets or quotes that were previously represented as text. That is expected, but it means the decoded result should not be inserted into HTML with an unsafe rendering method. Review the destination before pasting.
Avoid accidental repeated conversion
Escaping an already escaped ampersand produces another layer, such as &amp;. The tool does not guess whether existing references were intended as text or markup. Likewise, decoding is one pass: &lt; becomes <, not a less-than sign in the same operation. A deliberate one-pass model makes each transformation easier to inspect.
Method and supported input
Encoding uses direct character substitution. Decoding recognizes the documented names and numeric Unicode values with terminating semicolons. Invalid scalar values become the replacement character.
- Only the listed named references are required.
Limitations
- This is not a complete HTML parser or XSS sanitizer.
- HTML-specific legacy control-code remapping and semicolon omission rules are not implemented.
Common questions
Why does © remain unchanged?
The decoder supports a small documented set of names plus numeric references. Use © for that character here.
Will a script tag run after decoding?
No. The result is displayed in a read-only text field, never inserted as HTML.