HTML Entity Encoder and Decoder
HTML needs five characters escaped: & becomes &, < becomes <, > becomes >, " becomes " and ' becomes '. Decoding <b> gives <b>.
How to use
- Choose Encode to turn text into entities, or Decode to turn entities back into text, then paste your text.
- When encoding, pick how far to go. Basic escapes only the five characters that are unsafe in HTML. Named uses names such as © where one exists. Decimal and Hex turn every non-ASCII character into a numeric entity.
- Copy the result. When decoding, the tool also tells you how many entities it found.
How it works
An HTML entity starts with &, ends with a semicolon, and stands for one character. It can be a name (&), a decimal code point (&) or a hex code point (&). All three forms mean the same thing.
Five characters must be escaped in text and attribute values: & < > " and '. If a literal & or < is left in, the browser may read it as the start of an entity or a tag. The apostrophe is written as ' because ' is not part of HTML 4.
Named entities exist for the Latin-1 range (accented letters, ©, ®, £ and similar), plus common typography such as —, … and €. A character with no name, such as a Korean letter or an emoji, always uses a numeric entity. Emoji are encoded by code point, so one emoji is one entity, not two.
Decoding leaves anything it does not recognise as it is. A numeric entity for zero, for a value above U+10FFFF, or for a surrogate half becomes the replacement character U+FFFD, as browsers do.
Frequently used entities
| Character | Name | Number |
|---|---|---|
| & | & | & |
| < | < | < |
| > | > | > |
| " | " | " |
| ' | (none in HTML 4) | ' |
| non-breaking space | |   |
| © | © | © |
| € | € | € |
| — | — | — |
| … | … | … |
FAQ
Does encoding protect me from XSS?
Escaping the five characters is the right fix when you place untrusted text inside HTML element content or a quoted attribute. It does not help inside script blocks, inside unquoted attributes or in URLs, which each need their own escaping.
Do I need to encode accented letters or emoji?
Not if the page is served as UTF-8, which is the default today. Use numeric entities only when your file or system cannot hold those characters.
What is the difference between and a normal space?
A non-breaking space looks like a space but keeps the words on both sides together on one line, and several in a row are not collapsed. Use it sparingly for layout.
Why is a name like &foo; left unchanged?
The decoder knows the Latin-1 names and the common ones listed in the guide, about 130 in all. An entity it does not know is kept as written instead of being guessed.
Is my text sent to a server?
No. Encoding and decoding run in your browser.