HTML Entity Encoder and Decoder Online

Escape text so it can be placed safely in HTML, or turn entities such as &, é and 😀 back into readable characters.

How to use the HTML entity encoder

Paste text and press Encode to escape it, or paste HTML with entities and press Decode to get plain characters back. Two settings control encoding:

Only special characters escapes the five characters that can break HTML: &, <, >, " and '. Everything else, including accented letters and emoji, stays as it is. This is the right choice for UTF-8 pages, which is nearly all of them.
Special characters and all non-ASCII additionally replaces every character outside plain ASCII, for example when a template, email system or legacy database cannot handle UTF-8.

Entity style chooses how non-ASCII characters are written: as a named entity such as é where a common name exists, otherwise as a number, or always as decimal (é) or hex (é). The apostrophe is written as ' because ' is not defined in HTML 4.

Decoding understands all of the more than 2,000 named entities defined in the HTML standard, as well as decimal and hex references. It uses the browser's own HTML parser inside an inert document, so tags in the input are treated as text and never executed.

Worked examples

Input:   <a href="/x">Tom & Jerry's</a>
Encoded: &lt;a href=&quot;/x&quot;&gt;Tom &amp; Jerry&#39;s&lt;/a&gt;

Input (all non-ASCII, named):  café €5 © 😀
Encoded:  caf&eacute; &euro;5 &copy; &#128512;

The emoji has no named entity, so it falls back to its decimal code point. Decoding <p>café 😀 gives <p>café 😀.

When do you need entities?

Showing code or user input on a page, so that <script> appears as text instead of being run. This is the core of preventing cross-site scripting (XSS).
Putting text inside an attribute value, where an unescaped " would end the attribute early.
Writing a literal & in a URL inside href, which should be & in the HTML source.
Characters that are invisible or hard to type, such as a non-breaking space ( ) or a soft hyphen ().

Common mistakes

Double encoding. Encoding text that is already encoded turns & into &amp;, which then shows up literally on the page. Decode first if you are not sure.
Forgetting the semicolon. Browsers forgive &copy without a semicolon in some places but not others. Always write the full ©.
Relying on entities inside script or style. Content of <script> and <style> elements is not entity-decoded, so escaping rules there are different.
Treating encoding as sanitising. Escaping makes text safe to display. It does not make untrusted HTML safe to render as HTML; that needs a sanitiser.

Frequently asked questions

What is an HTML entity?

An HTML entity is a text code that stands for a character, starting with an ampersand and ending with a semicolon. It can use a name like & or a number like &. The browser displays the character instead of the code.

Which characters must be escaped in HTML?

In normal text, escape the ampersand and the less-than sign. Inside attribute values, also escape the quote character used around the value. Escaping the greater-than sign and both quote types everywhere is a simple, safe habit.

Should I encode accented letters like é as entities?

Not if your page is served as UTF-8, which is the default for modern sites. Then é can be written directly. Encoding all non-ASCII characters is only useful for systems that cannot handle UTF-8.

What is the difference between named and numeric entities?

Named entities such as é are easier to read but only exist for a limited set of characters. Numeric entities such as é or é work for every Unicode character, including emoji.

Is it safe to paste untrusted HTML into the decoder?

Yes. Decoding uses the browser's HTML parser in an inert document with no scripts, and the result is placed in a plain text box. Nothing in the input is executed or loaded.

HTML Entity Encoder and Decoder