HTML Entity Encoder and Decoder
Escape the characters that HTML treats as markup, or turn character references back into text.
Runs in your browser. Your input is not sent anywhere.
What this tool does
In HTML, a few characters start markup: < opens a tag, & starts a character reference, and quotes end an attribute value. To show such a character as text, a page writes a character reference instead, for example < for <. References also let you write any character by its number, which is useful when a file must stay in plain ASCII.
The tool works in both directions. Encoding replaces the special characters, and optionally every character outside ASCII, with references. Decoding replaces named references such as é and numeric references such as é or é with the characters they stand for.
How to use it
- Choose a mode. “Encode special characters” is what you need to put text into HTML safely. “Encode special and non-ASCII characters” also writes letters such as é and symbols such as € as references. “Decode references” goes the other way.
- Paste or type the text. The result updates as you type.
- Read the notes below the result when decoding: they count the references that were left unchanged or that browsers read differently from how they are written, and show the first of each.
- Copy the result.
How the result is derived
Encoding replaces five characters: & with &, < with <, > with >, the double quote with " and the apostrophe with '. The numeric form is used for the apostrophe because ' was not part of HTML 4. With non-ASCII encoding on, every character from U+007F upwards is written with its name when it has one in HTML 4, for example ©, and otherwise as a hexadecimal reference of the whole code point, for example 😀 for an emoji.
Decoding recognizes three forms: &name;, &#decimal; and &#xhex;. A named reference must end with a semicolon, so text such as “R&D” is left as it is. Browsers still accept about a hundred old names such as © and & without a semicolon in text; the tool leaves those unchanged and does not count them. Numeric references are decoded with or without the semicolon, as in browsers.
The tool knows the 252 names of HTML 4 plus '. HTML defines more than 2,000 names, most of them mathematical symbols. A reference with a name the tool does not know is left unchanged and counted in a note that names the first one, so an unknown name never disappears silently.
Some numbers do not produce the character with that number. Browsers replace �, numbers above 10FFFF and the surrogate range D800 to DFFF with the replacement character U+FFFD, and read most of the numbers 128 to 159 (27 of the 32) as the characters of the Windows-1252 encoding: – shows an en dash, not a control character. The tool does the same and says so in a note.
Worked example
Encoding a snippet of HTML so that a page shows it as text:
<a href="/search?q=tom&jerry">Tom & Jerry’s “best”</a><a href="/search?q=tom&jerry">Tom & Jerry’s “best”</a><a href="/search?q=tom&jerry">Tom & Jerry’s “best”</a>Decoding either result gives back the input exactly. Decoding “5 < 7 && α ≠ β” gives “5 < 7 && α ≠ β”.
Reference: frequently used references
| Character | Named | Decimal | Hexadecimal |
|---|---|---|---|
| & (ampersand) | & | & | & |
| < (less-than) | < | < | < |
| > (greater-than) | > | > | > |
| " (quotation mark) | " | " | " |
| ' (apostrophe) | ' | ' | ' |
| No-break space | |   |   |
| © (copyright) | © | © | © |
| — (em dash) | — | — | — |
| € (euro) | € | € | € |
| → (right arrow) | → | → | → |
Which characters must be escaped depends on where the text goes. In element content, & and < are enough. Inside an attribute value, the quote character that delimits the value must be escaped too. Encoding all five is the simple rule that works for element content and quoted attribute values.
Common mistakes
- Encoding twice. Text that is already encoded becomes &lt; and shows the reference instead of the character. Encode once, at the point where text is put into HTML.
- Using HTML encoding for other contexts. Text inside a script, a style sheet or a URL follows other rules; HTML entities do not make it safe there.
- Writing attributes without quotes. An encoded value in an attribute without quotes can still be broken by a space.
- Forgetting the semicolon. “© 2026” happens to work in browsers for historic names, but most names need the semicolon, and a missing one can join with the following letters.
- Using for layout. A run of no-break spaces does not adapt to screen width; use CSS for spacing.
Sources
Frequently asked questions
- What is the difference between an entity and a character reference?
- In everyday use both words mean the same thing: text such as & or & that stands for a character. The HTML standard calls them named and numeric character references; “entity” is the older term from SGML and HTML 4.
- Does encoding make user input safe against cross-site scripting?
- Encoding the five special characters makes text safe inside HTML element content and inside quoted values of ordinary attributes such as title or alt. It does not make text safe inside script or style elements, in URL attributes such as href or src, in style attributes or in event handler attributes such as onclick. Use the automatic escaping of your template engine, and a sanitizer or context-specific encoding for those places.
- Why does the tool not know a name such as ✓?
- The tool knows the 252 names of HTML 4 plus ', which cover the characters pages usually spell by name. The HTML standard adds many more. Unknown names are left unchanged and counted, so you can replace them by hand or with a numeric reference.
- Should I encode non-ASCII characters?
- Usually not. A page served as UTF-8 can contain é, € and emoji directly, and the source stays readable. Encode them only when a system on the way cannot handle anything but ASCII.
- Is my text sent anywhere?
- No. Encoding and decoding happen in your browser. The text is only stored on your device if you turn on “Remember my input on this device”.
Last updated: September 29, 2026