HTML entities encoder and decoder
Tom & Jerry <3 becomes Tom & Jerry <3, so the text can sit inside a tag or attribute without breaking it. Decoding turns <div> back into angle brackets and stops on any unknown entity name. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Text
- Tom & Jerry <3
- Calculation mode
- Encode
- Result
- Tom & Jerry <3
- Encoding
- html_entities
- Input length
- 14
- Output length
- 21
This HTML entities encoder converts special characters into HTML entity markup and decodes named and numeric entities back into ordinary Unicode text. Encoding rewrites ampersand, less-than, greater-than, double quote, and single quote so fragments stay safe inside element content and attributes without breaking tags or attributes. Decoding accepts familiar named forms such as & and as well as decimal ' and hexadecimal ' references, and it fails loudly when a named entity is not recognized so typos never silently survive into production HTML. The path is fully deterministic: the same text and mode always produce the same result, with no network calls, no random salts, and no date-dependent shortcuts. Small checks include encoding Tom & Jerry into Tom & Jerry and decoding <div> back to angle brackets.
What HTML entities are and what this tool returns
HTML entities are textual escapes that stand in for characters that would otherwise be misread by a parser. An ampersand starts a character reference, so raw & in body text must become & if you intend a literal ampersand rather than the start of another entity. Angle brackets open and close tags, so < and > become < and > when you want those glyphs as data rather than markup structure.
Quotes often delimit attributes, so " becomes " and apostrophes are emitted as the numeric reference ' for broad compatibility with both HTML and XML attribute rules. This page implements that classic encode set on the encode path and the reverse on decode: named references from a fixed map of common XML, HTML4, and widely used HTML5 names, plus decimal &#N; and hexadecimal &#xH; forms for any valid Unicode scalar value.
Where HTML entity encode and decode fit in markup workflows
Developers meet HTML entities when they paste user text into templates, when CMS exports mix raw ampersands with double-escaped fragments, and when email or XML exporters need attribute-safe strings without a full sanitizer pass. Frontend teams decode entity-heavy copy pulled from legacy databases so UI components render true quotes, dashes, and non-breaking spaces instead of literal ’ sequences. Quality engineers generate deterministic encode and decode pairs for contract tests so a middleware that claims entity support cannot silently change & handling between releases.
Educators use the same tool when teaching the difference between named entities, decimal references, and hex references that modern HTML parsers accept.
What you can do with it
Safe template and attribute text
Encode titles, labels, and user snippets so ampersands and angle brackets cannot break tags or attributes.
Legacy CMS entity cleanup
Decode named and numeric entities from exported HTML or database fields back into plain Unicode for modern UIs.
FAQ
What does the HTML entities encoder cost?
It is free in your browser on this page.
Which characters are encoded?
Encode mode rewrites &, <, >, ", and ' into &, <, >, ", and '. Other characters are left unchanged.
What happens if a named entity is unknown?
Fix the name or use a numeric entity such as {.
Is the result deterministic?
Yes. The same text and mode always produce the same result with no network, randomness, or date-dependent behavior.
Can it decode numeric entities like ' and '?
Yes. Decoding understands named forms such as & and , decimal references such as ' and hexadecimal ones such as '. Each one must end with a semicolon to count as an entity.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/enc/html-entities \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"text":"Tom & Jerry <3"}'const res = await fetch("https://api.kit.forhosting.com/enc/html-entities", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"text": "Tom & Jerry <3"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/enc/html-entities",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"text": "Tom & Jerry <3"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/enc/html-entities", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"text":"Tom & Jerry <3"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"text":"Tom & Jerry <3"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/enc/html-entities", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"text": "Tom & Jerry <3"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "enc.html_entities",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
Use it free in the browser for template hygiene and content cleanup, or call the API at $0.002 per successful request when pipelines need reproducible entity transforms in CI and backend services.
What HTML entities are and what this tool returns
The JSON response always includes result for the transformed string, mode echoing encode or decode, encoding fixed to html_entities, and input_length plus output_length so tests can assert sizes. Decode also reports entities_decoded so you can confirm how many well-formed &...; sequences were rewritten. There is no partial silent skip for unknown names: either every named entity is defined in the map or the request fails with invalid_input.
How text and mode are read and how results stay reproducible
Encode walks the string character by character and replaces only the five special characters with their preferred entity forms, leaving letters, digits, and other Unicode unchanged so readable copy stays readable. Decode scans for well-formed entities that end with a semicolon: a name of letters and digits, a decimal code point, or a hexadecimal code point after #x. Numeric entities outside the Unicode scalar range or in the surrogate block are also rejected. The preferred payload field is text, with aliases input, value, s, and html so forms, query strings, and SDK clients can reuse the same contract without renaming columns. Mode defaults to encode and accepts decode explicitly; aliases op, direction, and action map to the same switch for scripts that already use those names. Bare ampersands that do not form a complete entity are left untouched so incomplete drafts do not explode, but a complete unknown name such as ¬anentity; raises invalid_input with a message that names the bad reference. Pair the free browser run on this page with the priced API when you need the identical mathematical result inside an automated pipeline without re-implementing entity tables yourself. Invalid inputs return invalid_input and are not charged, which keeps validation cheap while successful transforms remain a fixed item price at $0.002.
Where HTML entity encode and decode fit in markup workflows
Backend services encode dynamic titles and labels before embedding them in HTML snippets or JSON that later becomes HTML, preventing accidental tag injection from a single angle bracket. On this page the work runs entirely in your browser; through the API each successful lookup costs $0.002, failed validation is not charged, and nothing is stored after the response returns. That split — free interactive exploration and a priced, identical API — matches the rest of the KIT tier-A catalog and lets you move from a classroom demo to an automated pipeline without changing the encoded result. Pair it with HTML sanitize or minify helpers when you need broader markup cleanup, and with other encoding endpoints when you are building a small lab of free, deterministic text tools.
Integration use cases
Deterministic CI fixtures
Generate reproducible encode and decode pairs for unit tests, golden files, and contract checks across services.
Technical questions
What modes are supported?
mode=encode (default) turns special characters into entities. mode=decode turns named and numeric entities back into characters.