Paste text to escape the characters HTML treats as markup, or decode named and numeric entities back to plain text — instantly, in either direction. One-click copy on the result.
Every character HTML treats as markup — & < > " ' — is escaped so it displays literally.
QADIR OS agents escape, sanitise and format the text, code and config flowing through your site and docs — automatically, on your own machine.
Join Early AccessA handful of characters carry special meaning in HTML: the ampersand starts an entity, the angle brackets open and close tags, and quotes delimit attribute values. If you want to show those characters as themselves — a code snippet, a literal tag, a stray & in a headline — you have to replace them with escape codes called entities. This tool does that in one paste, and reverses it just as fast, turning <div> back into a real <div>.
<a href="x?a=1&b=2">Tom & Jerry</a>
<a href="x?a=1&b=2">Tom & Jerry</a>
By default the tool escapes the five characters that can break markup or open a security hole. Turn on Encode all non-ASCII to also convert accented letters, emoji and symbols into numeric entities — useful when a target system is limited to plain ASCII.
| Character | Named entity | Numeric | Why escape it |
|---|---|---|---|
& | & | & | Starts every entity — escape first |
< | < | < | Opens an HTML tag |
> | > | > | Closes an HTML tag |
" | " | " | Ends a double-quoted attribute |
' | ' | ' | Ends a single-quoted attribute |
The copyright sign can be written three ways that all render identically: © (named), © (decimal) or © (hexadecimal). Named entities read better; numeric entities always work, even for characters with no name. Pick the style with the Entity style dropdown — the decoder understands all three regardless of which you chose.
Any time text becomes part of a web page. Displaying code samples in a blog post, dropping user input into HTML without letting it run as markup (the root of many cross-site-scripting bugs), cleaning up entity-mangled text pasted out of a CMS, or debugging why & keeps showing up on your page — all of these are one paste away here.
No. Encoding and decoding are exact inverses of each other, so a round trip returns your original text character-for-character. Entities are just a different spelling of the same characters — the meaning and the visible result never change.
Everything runs in your browser as plain JavaScript. Your text is never uploaded, logged or stored on any server — refresh the page and it is gone. That makes it safe to paste private snippets, internal code, and confidential content.