HTML Entity Encoder and Decoder
Encode “Tom & Jerry <3 © 2026” and get “Tom & Jerry <3 © 2026”, ready to place in a page’s source. Decoding turns known names back into characters and rejects a misspelled one instead of letting it through. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Text
- Tom & Jerry <3 © 2026
- Calculation mode
- Encode
- Text
- Tom & Jerry <3 © 2026
Convert text to and from named HTML entities without installing a package or relying on a browser DOM. Encode mode protects markup-sensitive characters such as ampersands, angle brackets, quotation marks, and apostrophes, while also handling a practical set of common symbols and typography. Decode mode reverses recognized named entities and rejects unknown names instead of silently preserving a likely mistake.
Encode text before placing it in HTML
Use encode mode when plain text must be represented safely inside HTML source. An ampersand can begin an entity reference, angle brackets can be mistaken for tags, and quotation marks can interfere with surrounding syntax when text is assembled into markup. The converter replaces supported characters with named references such as <code>&amp;</code>, <code>&lt;</code>, <code>&gt;</code>, <code>&quot;</code>, and <code>&apos;</code>.
It also recognizes frequently used currency, legal, mathematical, punctuation, and spacing characters, including copyright, registered trademark, euro, nonbreaking space, dashes, curly quotation marks, bullets, and ellipses. Encoding is performed in one pass so the ampersands introduced by the conversion are not encoded a second time. Ordinary letters, numbers, whitespace, emoji, and unsupported characters remain unchanged.
This behavior makes the result readable while protecting the characters that commonly matter in markup. Remember that entity encoding is a text representation step, not a complete HTML sanitizer: it does not validate a document, remove unsafe tags from existing markup, or decide whether a value is safe for a JavaScript, CSS, or URL context.
Decode named entities with strict validation
Use decode mode when input contains named references and the original characters are needed for display, comparison, indexing, export, or further text processing. Each complete reference shaped like an ampersand, a name, and a semicolon is looked up in the capability’s fixed table. Recognized forms are replaced with their corresponding Unicode characters, preserving every part of the string around them.
Entity names are case-sensitive because differently capitalized names can have different meanings in HTML. Strict rejection is useful in automated pipelines because a misspelling such as <code>&copry;</code> does not quietly pass through and appear as broken text later. Text containing a plain ampersand without an entity-shaped name and semicolon remains unchanged.
This capability focuses deliberately on named entities; decimal and hexadecimal numeric character references are outside this contract. The same fixed mapping is used for every execution, so results do not depend on a browser version, external package, network response, locale, or mutable global data.
Choose the mode and integrate the result
Send two fields: <code>text</code> contains the source string and <code>mode</code> is either <code>encode</code> or <code>decode</code>. Both are required so an integration never guesses which direction was intended. For an encoder workflow, pass human-authored content before embedding it in markup and store or transmit the returned text.
For a decoder workflow, treat an unknown-entity error as a validation failure and correct the producer rather than suppressing it. For large systems, keep the conversion at a clear boundary: encode when entering an HTML representation and decode only when leaving that representation. Repeatedly alternating the modes can obscure ownership of escaping and may encourage accidental double encoding elsewhere in an application.
What you can do with it
Prepare user-visible text for markup
Convert ampersands, brackets, quotes, and common symbols into readable named references before placing text into generated HTML.
Normalize imported HTML text
Decode recognized named references before comparing, searching, exporting, or storing content as ordinary Unicode text.
Validate content pipelines
Fail immediately when a producer emits an unknown named entity, making typographical and mapping errors visible during automation.
FAQ
Which modes are accepted?
The mode must be exactly <code>encode</code> or <code>decode</code>. Any other value returns an invalid-input error.
Does decoding support numeric character references?
No. This capability handles named HTML entities. Decimal and hexadecimal numeric references remain unchanged.
Is entity encoding the same as sanitizing HTML?
No. Encoding converts supported characters to text references; it does not parse a document, remove tags, or secure every output context.
What happens if I decode a misspelled entity such as &copry;?
It is rejected and the unknown name is reported, instead of passing through and showing up later as broken text. Names are case-sensitive, so a differently capitalized name counts as a different entity.
Which characters stay unchanged when I encode?
Ordinary letters, numbers, spaces, emoji and characters without a supported name stay as they are. Only markup-sensitive characters and common symbols, such as the copyright sign, the euro sign, dashes, curly quotes and ellipses, are replaced.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/web/html-entity-convert \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"text":"Tom & Jerry <3","mode":"encode"}'const res = await fetch("https://api.kit.forhosting.com/web/html-entity-convert", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"text": "Tom & Jerry <3",
"mode": "encode"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/web/html-entity-convert",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"text": "Tom & Jerry <3",
"mode": "encode"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/web/html-entity-convert", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"text":"Tom & Jerry <3","mode":"encode"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"text":"Tom & Jerry <3","mode":"encode"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/web/html-entity-convert", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"text": "Tom & Jerry <3",
"mode": "encode"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "web.html_entity_convert",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Limits
timeout_sec | 30 |
max_crawl_pages | 25 |
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
The result is deterministic, suitable for repeatable builds, tests, content pipelines, templates, and API integrations.
Decode named entities with strict validation
If a complete named reference is not supported, the request fails with an <code>invalid_input</code> error that identifies the unknown entity.
Choose the mode and integrate the result
The response returns the converted <code>text</code> together with the applied <code>mode</code>, which makes logs and workflow records self-explanatory. A request costs $0.002 through the API, while the browser experience can run the same pure logic locally.
Technical questions
How much does an API request cost?
Each API request costs $0.002. The conversion uses one item as its billing unit.
What happens when a named entity is unknown?
Decode mode rejects the request with an invalid-input error that includes the unknown entity name.