HTML Encoder & Decoder
Escape text for HTML or turn character references back into readable text without rendering the result as markup.
Encoding processes Unicode code points. Lone UTF-16 surrogates are rejected before every mode because UTF-8 cannot preserve them. HTML5 names use the existing html-entities encoder, with numeric fallback. Decoding uses a detached textarea in one pass; literal < is escaped first. Strict mode decodes complete semicolon-terminated tokens only and preserves unknown or incomplete references exactly. Browser mode follows legacy semicolon rules and normalizes CR/CRLF and invalid numeric references according to HTML. Output is plain text, never executed. This is not a sanitizer or a guaranteed round trip.
Runs locally in this browser; no text is uploaded.
A QUICK WALKTHROUGH
How to use this tool
- Source text — Input: at most 100,000 UTF-16 units and 50,000 lines. Output: at most 1,000,000 units. Report: at most 4,000,000 units. The whole operation is rejected on overflow.
- Choose Encode or Decode, then select the range, entity style, or semicolon rule you need.
- Transform → Complete transformation report → Copy transformed text / Download report (UTF-8 TXT)
Explicit encoding choices
Special-character mode encodes ampersand, angle brackets, double quotes, and apostrophes. The broader mode also encodes every non-ASCII Unicode code point. Choose HTML5 named references when available, decimal numeric references, or hexadecimal numeric references.
HTML5 decoding without rendering
The decoder recognizes HTML5 named references plus decimal and hexadecimal numeric references. Strict mode requires semicolons; browser-body mode also accepts the legacy semicolon-less references recognized in HTML text. Unknown references stay unchanged. The decoded result is shown as text and is never inserted as live HTML.
Complete transformation report
Encoding processes Unicode code points. Lone UTF-16 surrogates are rejected before every mode because UTF-8 cannot preserve them. HTML5 names use the existing html-entities encoder, with numeric fallback. Decoding uses a detached textarea in one pass; literal < is escaped first. Strict mode decodes complete semicolon-terminated tokens only and preserves unknown or incomplete references exactly. Browser mode follows legacy semicolon rules and normalizes CR/CRLF and invalid numeric references according to HTML. Output is plain text, never executed. This is not a sanitizer or a guaranteed round trip.
Limits and local processing
Input: at most 100,000 UTF-16 units and 50,000 lines. Output: at most 1,000,000 units. Report: at most 4,000,000 units. The whole operation is rejected on overflow. Runs locally in this browser; no text is uploaded.
GOOD TO KNOW
Common questions
Does encoding sanitize arbitrary HTML?
It escapes text for HTML text content and quoted attribute values. It is not a complete sanitizer for URLs, CSS, JavaScript, or already-structured markup.
What happens to an unknown entity?
Encoding processes Unicode code points. Lone UTF-16 surrogates are rejected before every mode because UTF-8 cannot preserve them. HTML5 names use the existing html-entities encoder, with numeric fallback. Decoding uses a detached textarea in one pass; literal < is escaped first. Strict mode decodes complete semicolon-terminated tokens only and preserves unknown or incomplete references exactly. Browser mode follows legacy semicolon rules and normalizes CR/CRLF and invalid numeric references according to HTML. Output is plain text, never executed. This is not a sanitizer or a guaranteed round trip.
Why can browser-compatible decoding work without a semicolon?
HTML permits a limited legacy set of named references without semicolons in text. Use strict mode when you require explicit, unambiguous references.