HTML Entity Encoder / Decoder

How to Use the HTML Entity Encoder / Decoder

This free online HTML entity encoder and decoder converts special characters to their corresponding HTML entities and vice versa. Whether you need to safely embed text in HTML documents or decode entity-encoded strings back to readable text, this tool handles it instantly in your browser with no server communication.

What Are HTML Entities?

HTML entities are special codes used to represent characters that have special meaning in HTML or characters that cannot be easily typed on a keyboard. For example, the less-than sign (<) must be written as &lt; in HTML to prevent the browser from interpreting it as the start of an HTML tag. Similarly, ampersands (&) must be encoded as &amp; to avoid being treated as the start of an entity reference. Other commonly encoded characters include greater-than signs, double quotes, and single quotes.

When to Encode HTML Entities

HTML entity encoding is essential when displaying user-generated content on a web page to prevent Cross-Site Scripting (XSS) attacks. It is also necessary when embedding special characters in HTML attributes, writing HTML code samples in documentation, and working with internationalized content that includes non-ASCII characters. This tool supports encoding all five critical characters (ampersand, less-than, greater-than, double quote, single quote) by default, with an option to encode all non-ASCII characters as numeric entities for maximum compatibility.

Decoding Support

The decoder recognizes named entities such as &amp;, &lt;, &gt;, &quot;, &copy;, &trade;, and many more. It also handles numeric entities in both decimal (&#123;) and hexadecimal (&#x7B;) formats. This makes it useful for debugging HTML source code, extracting readable text from encoded content, and verifying that your encoding process works correctly.

Features

• Encode the five critical HTML characters by default
• Optional encoding of all non-ASCII characters to numeric entities
• Decode named entities, decimal numeric entities, and hexadecimal numeric entities
• Support for surrogate pairs (emoji and supplementary Unicode characters)
• Copy-to-clipboard functionality
• Entirely client-side -- no data leaves your browser

HTMLエンティティ エンコーダー / デコーダーの使い方

この無料オンラインツールは、特殊文字をHTMLエンティティに変換したり、 エンティティを元の文字に復元します。XSS対策やHTML文書内での安全な文字表示に 利用できます。全ての処理はブラウザ上で行われ、データは外部に送信されません。

HTMLエンティティとは

HTMLエンティティは、HTMLで特別な意味を持つ文字や、キーボードから直接入力しにくい 文字を表現するための特殊コードです。例えば、<（小なり記号）は&lt;と記述します。 &（アンパサンド）は&amp;とエンコードする必要があります。

対応エンティティ

デコーダーは&amp;、&lt;、&gt;、&quot;、&copy;、&trade;などの 名前付きエンティティに対応しています。また、10進数（&#123;）および 16進数（&#x7B;）の数値エンティティもサポートしています。

HTMLの二重エスケープとXSS対策 / Fix double-escaped HTML and context-specific XSS issues

html.escape等で文字参照を変換 / Convert HTML entities with html.escape and other APIs

JavaScript

// エンコード(最小5文字)
const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;")
  .replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
// DOM を使ったデコード
const dec = (s) => new DOMParser().parseFromString(s, "text/html").body.textContent;

Python

import html
html.escape('<div class="x">')   # '&lt;div class=&quot;x&quot;&gt;'
html.unescape("&amp;copy;")       # '©'

PHP

htmlspecialchars($s, ENT_QUOTES, "UTF-8");  // ENT_QUOTES で ' も対象に
html_entity_decode($s, ENT_QUOTES, "UTF-8");

scriptタグと©記号の変換例 / Escaping Script Tags and Symbols Like ©

<script>alert(1)</script>
→ &lt;script&gt;alert(1)&lt;/script&gt;   (タグとして実行されない)

"5 > 3 & 2 < 4"
→ 5 &gt; 3 &amp; 2 &lt; 4

©2026 → &copy;2026  (記号の安全な表記)

XSS調査の文字列を送信せず変換 / Convert XSS investigation snippets without uploading them

The strings you escape are usually fragments of your application: user-generated content samples, template snippets, or text you suspect caused an XSS report. This tool encodes and decodes entirely in your browser — no snippet ever reaches a server, nothing is logged, and it works offline. Open the DevTools Network tab to confirm: zero requests while converting.

エスケープ対象の文字列はアプリの断片やXSS調査中のデータであることが多いもの。 本ツールは変換の全てがブラウザ内で完結し、外部送信は一切ありません。 XSS対策の全体像はHTMLエスケープとXSS対策の基本で解説しています。