HTML entity encoder and decoder

What this tool does

Encoding covers the five characters that matter in HTML text and attributes. Decoding supports numeric entities and a short named list. ConvertPass never uses innerHTML with your input.

How to use it

1. Choose encode or decode.
2. Paste the text.
3. Copy the escaped result into a template that you control.

Privacy

This tool processes files and text locally in your browser. Your content is not uploaded or stored by this site.

ConvertPass does not include your input in analytics, URLs, or error reports. Encoding: UTF-8. Limit: 2 MB (2.00 MB).

Limitations

• Named-entity decoding is limited to amp, lt, gt, quot, apos, and nbsp.
• This is not an HTML sanitiser. It does not make untrusted HTML safe to render.

Example

<img alt="A & B">

<img alt="A & B">

Troubleshooting

nbsp did not become a space you can see

nbsp decodes to U+00A0, a non-breaking space. It is not a normal U+0020 space.

FAQ

Can I preview the HTML?

No. Previewing untrusted HTML is how XSS demonstrations become real bugs. Copy the text into a local file if you need a preview under your own control.

Does this stop XSS?

Encoding is one part of output encoding. It is not a complete sanitiser, and it does not handle every HTML context such as JavaScript inside event handlers.

Why not decode all named entities?

The WHATWG named-entity list is huge. Supporting the five core entities plus numeric forms covers the usual converter jobs without pretending to be a browser parser.

Are emoji numeric entities decoded?

Yes, if they are well-formed numeric entities in the valid Unicode range.