How to use the HTML Entity Encoder and Decoder
- Choose Encode to escape text for HTML, or Decode to turn entities back into characters.
- When encoding, pick Special only to escape just the reserved characters, or Special + non-ASCII to convert accents, symbols and emoji too.
- Choose named entities (
©), decimal (©) or hex (©) output. - Paste your text on the left and copy the converted result from the right.
Features
- Escapes the five reserved HTML characters safely
- Optional conversion of every non-ASCII character, including emoji
- Named, decimal or hexadecimal entity output
- Decodes all 2,000+ HTML5 named entities and numeric references
- Warns about unknown entity names and double-encoded text
- Processes everything locally in your browser
What HTML entities are
An HTML entity is a short code that stands for a character. It starts with an ampersand and usually ends with a semicolon. Entities exist because a few characters have special meaning in HTML: a < starts a tag and an & starts an entity, so if you want those characters to appear as text on a page you must write them differently. Entities also let you type characters that are hard to enter on a keyboard, such as © or →, or that would be invisible in source code, like a non-breaking space.
There are three ways to write the same character. A named entity uses a memorable word, such as ©. A decimal reference uses the Unicode code point in base 10, ©. A hexadecimal reference uses base 16, ©. Browsers treat all three identically. Named entities are easier to read, but only some characters have names; numeric references work for every one of the more than one million Unicode code points.
The five characters you must escape
| Character | Named | Decimal | Why it matters |
|---|---|---|---|
| & | & | & | Starts every entity |
| < | < | < | Starts a tag |
| > | > | > | Ends a tag |
| " | " | " | Ends a double-quoted attribute |
| ' | ' | ' | Ends a single-quoted attribute |
This tool writes the apostrophe as ' even in named mode, because ' was not part of HTML 4 and some older email clients and parsers still do not recognize it.
Escaping and security
Escaping these characters is the main defense against cross-site scripting (XSS) when you insert user-supplied text into a page. If a comment containing <script> is escaped, the browser shows the text instead of running it. Keep in mind that HTML escaping only protects text placed in the body of an element or inside a quoted attribute. Values that go into a URL, a JavaScript string or a CSS rule need their own kind of encoding, such as URL encoding for links.
When to encode non-ASCII characters
If your page is saved and served as UTF-8, which it should be, accented letters and emoji can be written directly and do not need entities. Converting them is still useful when you paste content into a system with an unknown or legacy character set, write HTML email templates that pass through many mail servers, or need to see exactly which invisible characters a string contains. Decoding is the reverse problem: text copied from a CMS, an RSS feed or a database export is often full of ’ and that you want to turn back into plain characters.
Common pitfalls
- Double encoding. Escaping text that is already escaped turns
<into&lt;, and readers see the code instead of the symbol. The decoder warns when a result still contains entities. - Missing semicolons. Browsers forgive
©without a semicolon for some old names, but not for all of them. Always include it. - Case sensitivity. Entity names are case-sensitive:
Éis É,éis é. - Numbers 128–159. For historical reasons browsers read
–as an en dash from the Windows-1252 character set rather than as a control character. This decoder does the same.
Frequently asked questions
Which characters must be escaped in HTML?
Always escape the ampersand and the less-than sign in text, and the greater-than sign too for safety. Inside attribute values, also escape the quote character that surrounds the value, usually the double quote.
Should I use named or numeric entities?
Both work in every browser. Named entities are easier to read, while numeric ones cover every Unicode character, including emoji that have no name.
What is and when should I use it?
It is a non-breaking space: it looks like a normal space but stops a line from wrapping at that point, for example between a number and its unit. Use CSS margins or padding rather than rows of them for layout.
Does encoding HTML make user input completely safe?
It makes text safe to place inside HTML elements and quoted attributes. Data inserted into scripts, URLs or styles needs encoding for that context as well.
Why does my decoded text still show entities?
The original was probably encoded twice, so one round of decoding only removes the outer layer. Use the Decode again button to remove the next layer.