PRPickrack

HTML Entity Encoder / Decoder

Escape HTML special chars (<, >, &...) or decode back. Named, numeric, or all-non-ASCII modes.

0 chars
0 chars

Escape HTML special chars or decode entities. Named (&amp;) or numeric (&#38;) output. Built for XSS-safe HTML.

HTML Entity Encoder / Decoder converts characters that would break HTML markup (<, >, &, ", ') into safe entity references — and decodes them back. Use it to escape user content before injection, to display HTML source code inside HTML, or to make non-ASCII text portable across templates.

Three encode modes: Named (use &amp; / &lt; / &copy; etc. where possible — most readable), Numeric (use &#38; / &#60; — most portable, no entity list dependency), or All (force every non-ASCII char to its entity, preferring named when available — most defensive for legacy systems).

Free, no signup, browser-side. Pickrack handles the ~40 most common named entities (HTML5 has 2,231 named — full list is on the roadmap) and full decimal / hex numeric entities for the entire Unicode range.

Key features

  • Encode + Decode in one tool — Toggle modes. Swap button moves output back to input — useful for round-tripping or comparing encodings.
  • Three encode styles — Named (most readable), Numeric (most portable), All (force non-ASCII).
  • Decode all entity forms — Named (&amp;), decimal (&#38;), and hex (&#x26;) all decoded in one pass. Unknown entities pass through unchanged.
  • Live update — Output recomputes as you type. Character count for both panels.
  • Browser-side only — No upload, no logging — your unescaped HTML never leaves your tab.

How to use

  1. Step 1: Pick mode — Encode (text → entities) or Decode (entities → text).
  2. Step 2: (Encode only) pick style — Named for human-readable output, Numeric for systems that may not recognize HTML5 named entities, All if you need maximum defense.
  3. Step 3: Paste your string — Output updates live. Click Copy to grab it.

When to use

  • Prevent XSS — escape user-submitted strings before inserting into HTML (best practice: also use textContent or a template engine's auto-escape, but the entity form is the underlying mechanism)
  • Display HTML source in a blog post — escape <script>...</script> so the browser shows the literal tags
  • Email HTML templates — older email clients sometimes mis-render UTF-8; encoding non-ASCII to entities is defensive
  • Encode HTML attribute values — single/double quotes inside attributes need to be entities or escaped
  • Decode entities from a scraped page — when you copy text from a rendered HTML page, sometimes raw entities sneak through

Frequently asked questions

Should I use named or numeric entities?

Named (&amp;) for readability when humans will see the source. Numeric (&#38;) for maximum compatibility — every parser understands them, no entity-list lookup needed. Default to Named in normal web work, Numeric for embedded systems or older XML pipelines.

Which characters MUST be escaped in HTML body?

< and & always (they have syntactic meaning). > is technically optional but defensive. Inside attribute values, also " and ' matching the quote you use. Don't escape what doesn't need it — bloated HTML hurts readability and gzip slightly.

Does this protect against XSS?

Entity encoding is the foundational mechanism — but use it via your framework's auto-escape (React's JSX, Vue's {{ }}, Django templates, etc.), not by hand. Manual escaping is error-prone. This tool is for cases where you need the raw entity form (e.g., a static site generator).

Does this encode `&nbsp;`?

Pickrack's Named mode preserves a regular space as-is (it's printable ASCII). If you have a non-breaking space char \u00A0 in your input, encoding it produces &nbsp;. Decoding &nbsp; always produces a non-breaking space (U+00A0), not a regular space.

What about hex entities like &#x2014;?

Decoding handles both &#NN; (decimal) and &#xHH; (hex) entities — pickrack parses both. Encoding always uses decimal for compactness; hex is on the roadmap.

How is this different from URL encoding?

Different alphabets and goals. URL encoding uses %XX (%26 for &) inside URLs. HTML entity encoding uses &NAME; or &#NN; inside HTML markup. Wrong tool for the job → broken output. If you need both (e.g., a URL inside an HTML attribute), apply URL encoding first, then HTML entity encoding.

Related tools

URL Encoder / Decoder

Percent-encode URL params or decode them. encodeURIComponent or encodeURI behavior.

Base64 Encoder

Encode and decode Base64 strings. Supports text and file modes. Browser-side, instant.

JSON Formatter

Format, validate, and minify JSON. Detects errors with line numbers. Browser-side, your data never leaves your device.