HTML Entity Encoder / Decoder
Turn special characters into HTML entities — or turn any entity soup back into plain text. Reserved characters are always escaped safely, named entities are used where they exist, and everything runs instantly in your browser.
Off leaves other-language text and emoji untouched. On converts every character above ASCII into a numeric entity instead.
Type in either box — the other updates instantly. The ampersand, angle brackets and quote marks are always escaped; everything else keeps a named entity when one exists.
Why unescaped text breaks HTML
HTML uses a handful of characters as its own syntax: & starts a character reference, < and > open and close a tag, and the quote marks close an attribute value. If those characters appear raw inside text that ends up inside an HTML page — a username, a code comment, a search query — the browser's parser can misread them as markup instead of the words they were meant to be. Encoding text into HTML entities first sidesteps the problem entirely: the entity always renders back as the original character, and it can never be mistaken for a tag, an attribute boundary, or the start of another entity.
Named vs. numeric entities — and why this tool prefers named
An HTML entity comes in two flavors. A named entity is a short mnemonic defined in the HTML specification — amp for &, copy for the copyright sign, euro for the currency sign — written as an ampersand, the name, and a semicolon. A numeric entity spells out the character's Unicode code point instead, in decimal or hexadecimal, and HTML understands one for every character that exists, named or not. This tool always uses the named form when a character has one, from a table of the 253 standard HTML4 named references, because it stays readable in raw HTML, and only falls back to a numeric entity for the rest — and only when Encode all non-ASCII characters is turned on.
Example 1 — escaping a snippet before it goes on the page. Typing Tom & Jerry says "hi" <b>bold</b> into Text and pressing Encode produces Tom &amp; Jerry says &quot;hi&quot; &lt;b&gt;bold&lt;/b&gt; — every reserved character becomes its named entity, so a browser renders those exact words as plain text instead of trying to start a bold tag.
Example 2 — the non-ASCII toggle in action. Encoding 안녕 😀 hello with the toggle off leaves it exactly as typed, since Korean and emoji have no named entity and modern browsers already handle UTF-8 correctly. Turn the toggle on and the same input becomes 안녕 😀 hello — useful only when the output must be plain ASCII, such as an old email template.
Example 3 — decoding removes one layer at a time. Pasting &amp; and <br> into HTML-encoded and pressing Decode gives & and <br> in Text — the double-encoded ampersand loses one layer and the tag entities become literal angle brackets. If text was accidentally encoded twice, press Decode twice.
Common HTML entities reference
These cover the characters that come up most often when writing HTML by hand or cleaning up scraped content:
| Entity | Renders as | Character |
|---|---|---|
& | & | Ampersand |
< | < | Less-than sign |
> | > | Greater-than sign |
" | " | Double quote |
' | ' | Apostrophe |
| Non-breaking space | |
© | © | Copyright sign |
® | ® | Registered trademark |
™ | ™ | Trademark sign |
€ | € | Euro sign |
£ | £ | Pound sterling |
¥ | ¥ | Yen sign |
¢ | ¢ | Cent sign |
° | ° | Degree sign |
± | ± | Plus-minus sign |
× | × | Multiplication sign |
÷ | ÷ | Division sign |
– | – | En dash |
— | — | Em dash |
… | … | Horizontal ellipsis |
‘ | ‘ | Left single quote |
’ | ’ | Right single quote |
“ | “ | Left double quote |
” | ” | Right double quote |
• | • | Bullet |
§ | § | Section sign |
This tool recognizes all 253 standard HTML4 named references when encoding — not just the ones listed above — and its decoder understands every named, decimal and hexadecimal entity a real browser understands, since decoding is delegated to the browser's own HTML parser.
Entities and cross-site scripting (XSS)
Escaping isn't only a display nicety. Most stored and reflected XSS vulnerabilities start the same way: text a user controls is written into an HTML page without escaping the five structural characters first, so a payload like <img src=x onerror=alert(1)> is parsed as a real tag instead of harmless text. Server-side templating engines almost always auto-escape by default for exactly this reason. This tool is for previewing, debugging and hand-authoring entity-encoded strings client-side — for production output, escape untrusted text on the server or through your framework's built-in escaping, and treat this page as a reference and a sandbox rather than the security boundary itself.
Common mistakes and limits
- Double-encoding: encoding text that already contains entities turns
&amp;into&amp;amp;— decode first if you're not sure whether the text is already encoded. - Confusing this with URL encoding: HTML entities and percent-encoding (
%20) solve different problems — entities are for text inside HTML documents, percent-encoding is for text inside a URL. - Malformed entities: a stray
¬ followed by a valid name or number, or a missing trailing semicolon, is simply left as-is by the decoder rather than causing an error, matching how real browsers recover from bad markup.
Sources & further reading
Frequently asked questions
What are HTML entities, and when do I need to encode text?
HTML entities are text sequences like &, < and © that stand in for a character HTML would otherwise read as markup, or one with no keyboard key. Whenever text that a user typed — a comment, a search box, a form field — gets inserted into an HTML page, the characters & < > and the quote marks need to become entities first; otherwise a browser can misread part of that text as a tag or an attribute boundary instead of plain words. This is also the root cause of many cross-site scripting (XSS) bugs, so encoding untrusted text before it reaches the page is a basic security habit, not just a display fix.
Which characters must always be escaped, and why does that matter for security?
Five characters carry structural meaning in HTML: & begins an entity, < and > open and close a tag, and the double and single quote marks end an attribute value. This tool always converts those five to &, <, >, " and ' regardless of any toggle, because leaving even one of them raw is enough for a browser to treat user-supplied text as markup — the classic path to a stored or reflected XSS bug. Everything else is optional and depends on where the text is used.
What is the difference between a named entity like & and a numeric one like &?
Both refer to the exact same character — an ampersand — but a named entity uses a short mnemonic (amp, copy, euro) defined in the HTML specification, while a numeric entity spells out the character's Unicode code point in decimal (&) or hexadecimal (&) form. Named entities are easier for a person reading raw HTML to recognize, but only a few hundred characters have one; anything without a name falls back to a numeric entity, which HTML understands for every Unicode character that exists. This tool always prefers the named form when one exists and only falls back to numeric &#NNNN; entities for characters that have no name.
Will encoding mangle Korean, Chinese, Arabic or emoji text?
No, not by default. With Encode all non-ASCII characters turned off, this tool only touches the characters that are actually unsafe or have a well-known named entity, and leaves other-language text and emoji exactly as typed, since modern browsers render UTF-8 correctly without any encoding. Turning the toggle on instead converts every character above the ASCII range into a numeric entity — useful when you need output that only contains plain ASCII bytes, for example an old email template or a system that cannot declare UTF-8.
Is my text sent to a server when I encode or decode it here?
No. Encoding runs on a small built-in table of named entities plus a numeric fallback, and decoding uses the browser's own HTML parser through a hidden, never-inserted textarea element, so it understands every entity a real browser understands — without ever sending your text anywhere. Nothing is uploaded, there is no sign-up, and only your last input and toggle choice are kept in this browser's local storage for convenience.