How to use this tool
- Enter the source in the input field.
- Choose sensitive-character, decimal or hexadecimal encoding, or select Decode supported entities.
- Valid input updates after a brief typing pause. You can also use the main action button. Resolve errors before copying or downloading.
- Clear input keeps the conversion settings; Undo input change restores the previous inputs after clear or reverse. Reset restores the example and default settings.
Understanding the output
Encoding replaces ampersand, less-than, greater-than, double quote, and single quote. Decoding supports amp, lt, gt, quot, apos, nbsp, and decimal or hexadecimal numeric references. Unsupported named references remain unchanged so the tool does not silently invent a character.
If the text belongs in a URL value instead of HTML text, use the URL Encoder and Decoder because the escaping rules are different.
Showing markup as text
<b>A & B</b> becomes <b>A & B</b>. Decoding that output once restores the original text string, but does not render a bold element. Encoding A😀 in hexadecimal mode produces A😀. Reverse using output restores A😀.
Escaping depends on the output context
HTML text, JavaScript strings, CSS values, and URL parameters use different rules. This utility converts a small set of HTML-sensitive characters; it is not a universal sanitizer for every place that accepts user input. In an application, use the framework’s context-appropriate escaping and safe DOM APIs rather than manually assembling markup from untrusted strings.
Decoding can introduce angle brackets or quotes that were previously represented as text. That is expected, but it means the decoded result should not be inserted into HTML with an unsafe rendering method. Review the destination before pasting.
Avoid accidental repeated conversion
Escaping an already escaped ampersand produces another layer, such as &amp;. The tool does not guess whether existing references were intended as text or markup. Likewise, decoding is one pass: &lt; becomes <, not a less-than sign in the same operation. A deliberate one-pass model makes each transformation easier to inspect.
Method and supported input
Encoding uses direct character substitution. Decoding recognizes the documented names and numeric Unicode values with terminating semicolons. Invalid scalar values become the replacement character.
All-character numeric encoding walks Unicode code points rather than UTF-16 units. Decoding remains one pass with six named references and numeric entities; it is not a full HTML parser.
- Only the listed named references are required.
Limitations
- This is not a complete HTML parser or XSS sanitizer.
- HTML-specific legacy control-code remapping and semicolon omission rules are not implemented.
- All-character numeric encoding rejects NUL and unpaired surrogates. It does not implement HTML legacy control-code remapping.
Common questions
Why does © remain unchanged?
The decoder supports a small documented set of names plus numeric references. Use © for that character here.
Will a script tag run after decoding?
No. The result is displayed in a read-only text field, never inserted as HTML.
Can I decode several layers in one conversion?
No. Each conversion is one pass. For example, &lt; becomes < first. Review the result before running another decoding pass.
Sources and further reading
Reviewed on