Skip to content
Page Utils

HTML Encode

An HTML encode tool turns reserved characters into HTML character references so they display as literal text in markup, and can decode those entities back. This page uses a reserved-set encode plus optional non-ASCII numeric character references. It is not an XSS sanitizer, not a live HTML preview host, and it does not upload your paste.

Paste plain text (Encode, default) or a string with HTML entities (Decode). Encode turns characters like &, <, >, ", and ' into character references; Decode reverses named and numeric entities. Everything stays in this tab — nothing is sent to Page Utils.

Closing the tab drops both fields. We do not write the paste to localStorage. This is entity escaping for drafts and snippets, not CMS sanitization and not the same as URL Encode on this hub.

HTML encode workspace

Encode entities

Encode reserved characters only: & → &amp;, < → &lt;, > → &gt;, " → &quot;, ' → &#39;. Optional non-ASCII numeric escape is off. Not an XSS sanitizer.

Entity-encoded output

Entity-encoded text will appear here.

HTML character references for drafts and snippets — not DOMPurify, not an XSS sanitizer, and not the same as URL Encode. Closing the tab drops the paste.

How does the HTML Encode work?

  1. 1. Paste text or HTML entities

    Encode is the default for turning reserved characters into character references. Switch to Decode when you already have &amp; / &#…; style entities.

  2. 2. Read the output

    Encode produces entity-escaped text you can paste into docs or examples; Decode restores characters when entities are recognized.

  3. 3. Copy

    Use the result in a draft. This page does not sanitize HTML for safe CMS injection.

  4. 4. Close the tab

    The workspace clears; nothing was uploaded.

Questions about HTML Encode

What does this HTML Encode tool do?
It converts reserved characters into HTML character references (and can decode entities back) in your browser. Encode and Decode run in this tab. Nothing is uploaded.
Does HTML entity encoding protect against XSS?
No. Escaping reserved characters helps text display literally in HTML source examples. It is not DOMPurify, does not strip scripts or event handlers, and is not enough by itself as application security for untrusted HTML.
Which characters and entities are supported?
Encode covers the common reserved set (&, <, >, ", '). Decode understands those named forms plus decimal and hexadecimal numeric character references. Exotic or proprietary entities may pass through unchanged.
Is there a separate HTML decode page?
No. One canonical address with a trailing slash: /text-utilities/html-encode/. Use the Decode toggle on this page. There is no /html-decode/ slug and no /in/ geo duplicate.
Does this tool upload my text?
No. Conversion stays in this tab. We do not write the paste to localStorage and we do not send it to Page Utils servers. Closing the tab drops the workspace.
How is this different from URL Encode?
HTML encode uses character references for markup. URL Encode (on this same Text Utilities hub) uses percent-encoding (%XX) for URLs and query strings. Use each tool for its own alphabet.
Why is this under Text Utilities?
Entity escaping is a small text transform beside URL Encode and Markdown to HTML. Developer hub stays tokens, JSON tidy, UUID, Base64, and cron. Finance tools stay education-only deposit math and are not primary related chips here.
Can I escape non-ASCII characters too?
Yes, optionally. Encode defaults to the reserved set only. Turn on Escape non-ASCII as numeric entities to emit decimal character references for characters outside ASCII. Decode still reverses decimal and hex numeric references either way.

What else can I open?

These tools run in your browser. Page Utils does not store, upload, or write to localStorage the keys, tokens, or text you paste. Results are a convenience aid, not legal, tax, or security advice.