Delimiter.live
Encoding & Security Tools Runs in your browser Free · no account

HTML Entity Encoder and Decoder

This tool converts characters that have meaning in HTML — angle brackets, ampersands and quotes — into their entity form so they display as text instead of being parsed as markup, and decodes entities back into plain characters.

Options
Input 0 characters
Result

Your result will appear here.

Not sure where to start? Use Load example.

Results update automatically and are calculated on your device. Nothing you type is sent to a server.

Runs in your browser. Processing happens entirely in your browser. Nothing you enter is sent to Delimiter.live.

How to use the HTML Entity Encoder and Decoder

  1. Choose escape or unescape.
  2. Paste your markup or your entity-encoded text.
  3. Copy the result into your page, template or code sample.

Example

Input
<p>Hello & welcome</p>
Output
&lt;p&gt;Hello &amp; welcome&lt;/p&gt;

Common use cases

  • Displaying a code snippet on a page without the browser rendering it.
  • Pasting HTML into a CMS field that would otherwise interpret it.
  • Decoding entities that came back from an API or a feed.
  • Preparing example markup for documentation.

Limitations and things to watch for

  • Escaping the five HTML-significant characters is correct for text content and quoted attribute values. It is not sufficient inside a <script> block, inside a style attribute, or in an unquoted attribute — those contexts need context-specific escaping.
  • This tool is for display and authoring convenience. Application security depends on your template engine escaping output automatically; never rely on manually escaping user input.
  • Unescaping decodes named entities, decimal references and hexadecimal references.

Frequently asked questions

Which characters must be escaped in HTML?
Ampersand, less-than and greater-than always; double and single quotes as well inside attribute values. Escaping all five is the safe default and is what minimal mode does.
Does escaping here make my application secure?
No. Cross-site scripting is prevented by escaping at the point of output in your templates, in the right context. This tool is for authoring and debugging, not a substitute for that.
What is the difference between &amp;#60; and &amp;lt;?
Nothing to the browser — both produce a less-than sign. Named entities are more readable; numeric references work for any character and need no lookup table.

Share this tool