Skip to content
koducathome

HTML Entity Encoder & Decoder

Escape special characters as HTML entities or decode named and numeric entities back to text.

How to use this tool

Steps for using the HTML Entity Encoder.

  1. Choose Encode to escape text for HTML, or Decode to turn entities back into characters. Type or paste into the input panel — the output updates as you type, and Sample loads an example.
  2. When encoding, choose what to escape: Text content (& < >), Attributes (& < > " ', the safe default) or Every character (turns all text into references, e.g. to hide an email address from simple scrapers). Characters that will be replaced are highlighted in the input.
  3. Pick how to treat Non-ASCII characters — keep them, use named entities, or use hex or decimal references — and turn on Use `&apos;` if you prefer it to &#39;.
  4. Check the status bar for how many characters were escaped or decoded and which entities were used. When decoding, unrecognised entities are listed and left exactly as they were.
  5. Click the round arrow button to use the output as input and reverse the conversion, then Copy, Download or Expand the result.
  6. Use the Entity reference below to search by name, character or code (for example copy, é, 8364 or #xE9) and click any entry to copy it.

Example

Escape a snippet for display in HTML

Text
<p class="note">Tom & Jerry's "café" — 5 > 3 ✓ 😀</p>
Escaped (non-ASCII kept)
&lt;p class=&quot;note&quot;&gt;Tom &amp; Jerry&#39;s &quot;café&quot; — 5 &gt; 3 ✓ 😀&lt;/p&gt;

Common use cases

  • Escaping code samples before pasting them into HTML, a CMS or documentation.
  • Preparing user-visible text for an HTML attribute such as title or alt.
  • Decoding entity-laden text from RSS feeds, scraped pages or old database exports.
  • Converting special characters to numeric references for systems that only accept ASCII.
  • Checking what an unfamiliar entity like &rArr; or &#8212; actually renders as.

How HTML entity encoding works

In HTML, a few characters are syntax: < starts a tag, & starts a character reference, and " or ' end an attribute value. To show them as text they must be written as references — &lt;, &amp;, &quot; and &#39; (the numeric form is used for the apostrophe because &apos; was not defined in HTML 4). This tool always escapes these four characters plus >, which makes the output safe to place both between tags and inside quoted attribute values.

Beyond those, encoding is optional. A page served as UTF-8 can contain é or 😀 directly, which is why Keep as-is is the default. Numeric references are useful when the text must pass through a system that mangles non-ASCII characters: &#xE9; (hex) and &#233; (decimal) both mean é. The encoder walks the text by Unicode code point, so an emoji becomes a single reference like &#x1F600; rather than two invalid references to its UTF-16 surrogate halves.

Decoding recognises decimal (&#233;), hex (&#xE9;) and named references. The named table covers all HTML 4 entities — Latin-1 letters, Greek letters, arrows, mathematical symbols, typographic quotes and dashes, &nbsp;, &copy;, &trade;, &euro;, &hellip; and so on — plus a selection of common HTML5 names such as &check; and &star;, nearly 380 names in total. That is a subset of the 2,231 named references in the HTML Living Standard; an entity not in the table is left untouched and listed in a note.

Numeric references follow the browser rules from the HTML specification: &#0;, surrogate code points and values above U+10FFFF become the replacement character U+FFFD, and references in the range 128–159 are interpreted as Windows-1252 — so &#150; decodes to an en dash, as it does in every browser. Named references require their trailing semicolon here; browsers also accept a few legacy names without it (&amp in old markup), which this decoder deliberately leaves alone to avoid mangling text such as AT&T.

Limitations

  • The named entity table is a subset of the 2,231 HTML5 names; rare names are left undecoded.
  • Named references must end with a semicolon to be decoded.
  • Escaping protects HTML text and quoted attributes only — it is not sufficient inside <script>, <style>, URLs or unquoted attributes.
  • The tool does not parse or format HTML structure; use the HTML Formatter for that.

Frequently asked questions

Which characters must be escaped in HTML?

& and < always, in text content. Inside attribute values, also the quote character that delimits the value. Escaping >, " and ' everywhere, as this tool does, is the simplest rule that is safe in both places.

Does escaping entities prevent XSS?

It prevents injection in HTML text and quoted attributes, which covers the most common cases. It does not make data safe inside JavaScript, CSS, URLs (for example javascript: links) or unquoted attributes — those need context-specific encoding or validation. Use your framework's built-in escaping where possible.

Why is the apostrophe encoded as &#39; and not &apos;?

&apos; is defined in XML and HTML5 but was missing from HTML 4, so some older parsers and email clients do not recognise it. &#39; works everywhere.

Should I use named or numeric entities?

Numeric references work for every character and need no lookup table. Named ones are easier to read in source (&mdash; vs &#8212;). For UTF-8 pages, keeping characters as-is is usually best.

Is my text processed locally?

Yes. Encoding and decoding run in your browser; nothing is uploaded.