Paste text to escape &, <, >, " and ' for HTML, or paste entities such as é and é to decode them. Encoding always covers those five characters and can convert every character above code point 127 to a hex reference. Decoding uses the browser's DOMParser and never executes markup. Nothing is uploaded.
Runs in this tab · nothing is uploaded · Verify in 10 seconds →
Characters like <, > and & have special meaning in HTML, so literal text must be escaped as entities (<, >, &) before it is placed in markup. This tool escapes text for HTML and decodes entities (named like é or numeric like é) back into readable text.
Encoding always escapes the five HTML-critical characters (ampersand, angle brackets, double and single quotes), and, with the All non-ASCII toggle, also converts every character above code point 127 to a hexadecimal &#x…; reference. Decoding hands the string to your browser's own DOMParser and reads back the text content, so every entity the browser knows is handled. Both directions run in this tab.
~/faq
When the output must survive a non-UTF-8 pipeline, legacy email templates, ISO-8859-1 pages, systems that mangle multibyte characters. On a modern UTF-8 page you only need the five critical characters escaped.
' is not defined in HTML 4, so old parsers do not understand it. The numeric form ' works everywhere, which is why it is the safer default.
Escaping these characters is the right move for text placed in element content or quoted attributes. Other contexts (URLs, inline scripts, CSS, unquoted attributes) need their own context-specific encoding, not HTML entities.
No. DOMParser parses the string into an inert document that is never attached to the page, scripts do not run and images do not load. Only the resulting plain text is read out.
Chosen for the same job, not just the same category.