HTML entity encoder and decoder
Escape HTML-sensitive characters or decode HTML5 character references.
Input & settings
How to use this tool
Encoding escapes ampersands, angle brackets, and quotes. Decoding handles HTML5 named references and decimal or hexadecimal numeric references.
Limits and behavior
References require a terminating semicolon. Unknown or malformed references remain unchanged. Decoded output is plain text and is never executed or rendered as HTML. Input is limited to 1 MB and output to 3 MB. No input content is saved by CraftAI.
Encode or decode HTML entities in text
Convert characters to HTML-safe references or decode existing entity representations for compatible document workflows.
Is HTML entity encoding sufficient for every security context?
No. Safe handling depends on whether text enters HTML, an attribute, JavaScript, or a URL. Use context-aware output encoding.
Related tools: html to plain text · strip html tags safely