Orpheus

HTML Entity Encoder and Decoder

Escape text for HTML, or decode entities back to characters.

Options
Direction
Result

Everything is processed in this tab. Nothing you paste is sent anywhere.

Every tool runs entirely in your browser. Your files are never uploaded to a server.

HTML encoding replaces characters that have structural meaning — the angle brackets, ampersand and quotes — with named entities. It is how text containing markup is displayed as text instead of being interpreted as tags.

How to use HTML Encoder & Decoder

  1. Paste your text or HTML. Both directions work as you type.
  2. Choose encode or decode. Encode makes text safe to place in a page; decode turns entities back into characters.
  3. Copy the result. Nothing is sent anywhere.

About HTML entity encoding

HTML entity encoding exists because markup and content share a character set, and a handful of characters have to be reserved for structure. An unescaped less-than sign starts a tag, and an unescaped ampersand starts an entity, so any text containing them is ambiguous until it is escaped. The order of replacement is the classic bug: the ampersand must be replaced first, because every other escape introduces one, and replacing it last turns < into < and produces visible entity codes on the page. That is the origin of nearly every & you see in the wild. The more consequential point is that escaping is context-dependent and this handles only one context. HTML text and attribute values need these five characters escaped. Inside a script block, the correct escaping is JavaScript string escaping. Inside a URL it is percent-encoding. Inside a style attribute it is CSS escaping. Applying HTML escaping to a value that lands in a JavaScript context provides essentially no protection, which is why cross-site scripting defences are described as context-aware output encoding rather than simply "escaping" — and why building HTML by string concatenation remains the underlying hazard regardless of what is escaped.

Frequently asked questions

Which characters have to be escaped?
At minimum the ampersand, less-than and greater-than signs. Inside an attribute value the quote characters must be escaped too, because they would otherwise close the attribute early. Escaping the ampersand first matters — do it last and you double-encode everything else.
Is escaping enough to prevent XSS?
Only in the right context. Escaping these five characters is correct for HTML text and attribute values. It does not make text safe inside a script block, a style block, a URL or an event handler, each of which needs different escaping. Context-aware output encoding is the actual defence.
Why do I see & on a page?
Double encoding. Something escaped the text twice, so the ampersand of the first & was itself escaped. It usually means two layers of code are both being helpful. Decode once and check whether the result is already correct.
What is the difference between ' and '?
They produce the same apostrophe. ' is defined in XML and HTML5 but was not in HTML4, so the numeric ' is the safer choice in output that might be parsed by older tooling. Both decode correctly here.

Last updated