HTML Entity Encoder & Decoder
Turn text into HTML-safe entities and turn entities back into text, at three levels of encoding — the five special characters, all non-ASCII characters, or every character.
—
What this tool does
HTML reserves a handful of characters for its own syntax, so text that contains them has to be
escaped before it can be placed in a document safely. This tool encodes text into those entities,
and decodes them back. Encoding is offered at three levels, because “safe” means different things
in different contexts: escaping only the five reserved characters is enough for well-formed HTML,
while escaping every non-ASCII character produces output that survives a system which mishandles
UTF-8. Decoding accepts both named entities such as © and numeric
references in decimal or hexadecimal.
Which characters need escaping, and why
| Character | Entity | Why |
|---|---|---|
& | & | Starts an entity reference; leave it bare and the parser reads the next word as an entity name. |
< | < | Opens a tag, so bare text would be parsed as markup. |
> | > | Closes a tag; escaping it keeps stray text inert. |
" | " | Ends a double-quoted attribute value. |
' | ' | Ends a single-quoted attribute value. |
Numeric and named entities
A numeric character reference gives a code point directly. Decimal writes it as
© and hexadecimal as ©; both are the copyright sign. A
named entity is a shorter, memorable alias — © is the same character. Named
entities exist only for a few hundred characters, which is why this tool emits the five specials
as names and everything else as hexadecimal numeric references: the numeric form can express any
code point, including emoji, without a lookup table.
Example
| Mode | Input | Output |
|---|---|---|
| Special only | <b>café</b> | <b>café</b> |
| Special + non-ASCII | café | café |
| Every character | Hi | Hi |
| Decode | © — 😀 | © — 😀 |
Frequently asked questions
Which characters have to be escaped in HTML?
Five: the ampersand (&) because it starts an entity, the two angle brackets (< and >) because they open and close tags, and the two quote characters (" and ') because they end an attribute value. Escaping those five is enough to place any text safely in HTML text or in a quoted attribute.
What is the difference between the encode modes?
“Special characters” escapes only the five characters above, which keeps the output readable. “Special + non-ASCII” additionally turns every character above U+007F into a numeric reference, useful when the receiving system cannot be trusted to handle UTF-8. “Every character” turns the whole string into numeric character references.
What do numeric and named entities mean?
A numeric character reference gives the code point directly, either in decimal (©) or hexadecimal (©). A named entity is a predefined alias such as © for the same character. This tool emits named entities for the five specials and numeric references for everything else, and its decoder understands both.
Can it decode as well as encode?
Yes. Paste encoded HTML and it turns the entities back into text, including named entities like © — € and decimal or hexadecimal numeric references. Anything it does not recognise is left untouched rather than removed.
Will decoding HTML ever run scripts?
No. Decoding only replaces entity text with characters; it produces plain text and never inserts the result into the page as markup, so nothing is executed. You copy the decoded text out; you do not run it.
Is anything sent to a server?
No. Both directions run in your browser; the text never leaves your device.
Go deeper
Longer explanations of the problems this tool solves:
Sources
- HTML Standard, Character references — the syntax of named and numeric character references. html.spec.whatwg.org
- JSON-LD and XML escaping follow the same five-character rule for text nodes and attributes.
Everything runs in your browser — nothing you type is uploaded.