HTML Entity Encoder
Encode common HTML entities for safe text nodes, or decode them back. Not a full HTML sanitizer.
HTML entity encode / decode
Escape &, <, >, quotes for safe HTML text nodes, or decode common entities back.
Output
Which characters are escaped
Encode replaces five characters and nothing else. & becomes &, < becomes <, > becomes >, " becomes ", and ' becomes '. The sample <div class="x">A & B</div> encodes to <div class="x">A & B</div>. Letters, digits, and the rupee sign are left as themselves. The output is meant for an HTML text node or a quoted attribute. It is not a sanitizer: it does not remove script tags as elements, and it does not check URLs.
Decode recognises amp, lt, gt, quot, apos, and #39, each with a trailing semicolon. One pass is not a loop. &lt; becomes < because only & is replaced on that pass. Decode again to get <. Unknown entities such as or   are left unchanged. Named entities without a semicolon are left unchanged.
Encode and decode run as you type. There is no separate button. Use Encode before you drop a user string into HTML you will publish. Use Decode when a portal shows & instead of &. Do not encode twice: & becomes &amp; and the page will show the entity instead of the ampersand. A name like O'Brien encodes the apostrophe as ', so the attribute stays quoted. Hindi text and the rupee sign are not escaped.
How to use it
- Choose Encode or Decode. The output updates with the box.
- For a text node, encode the raw string, then put the result between tags.
- If you still see &lt; after one decode, decode a second time.
- Copy the output. This does not make the string safe against every HTML context, only these characters.
The text stays in this browser tab. GetFixMyFile does not upload it, store it, or include it in analytics.