HTML Entity Encoder & Decoder
Escape text for HTML, or turn &-style entities back into characters.
How to use HTML Entity Encoder & Decoder
- Paste the text or HTML.
- Choose Encode or Decode, and how much to encode.
- Copy the result.
How it works
Five characters have special meaning in HTML and must be escaped when you want them shown as text or placed in an attribute: & → &, < → <, > → >, " → " and ' → '. That is the recommended setting, and it is what prevents text from being interpreted as markup. On a UTF-8 page, which is every modern page, accents, symbols and emoji do not need encoding at all.
The other modes exist for older systems: names writes symbols and accented letters as named entities (© → ©, é → é), and every non-ASCII character writes numeric references that survive any character encoding. Decode understands named, decimal (©) and hexadecimal (©) entities; names it does not recognise are left exactly as typed and listed.
Everything runs in your browser. The text you paste is not uploaded, logged or saved, so configuration files, API responses and customer data stay on your device. Escaping output is one layer of protection against cross-site scripting; it must be applied in the right context by your application, and this tool does not make untrusted HTML safe.
Example
<b>Tom & Jerry</b> encodes to <b>Tom & Jerry</b>, which a browser displays as the literal text.
Frequently asked questions
Which characters must be escaped in HTML?
&, < and > in text, plus " and ' inside attribute values. Escaping all five everywhere is the simple, safe habit.
Do I need to encode accented letters and emoji?
Not on a UTF-8 page. Encoding them is only needed for legacy systems or e-mail clients that mishandle character sets.
What is the difference between &nbsp; and a space?
is a non-breaking space: it prevents a line break at that point and does not collapse with neighbouring spaces.
Why was an entity not decoded?
It is not in the list of common named entities this tool knows, or it is missing its semicolon. It is left untouched so nothing is corrupted.
Limitations
- Knows the common named entities (about 150), not all 2,231 in the HTML standard; unknown names are left as typed and reported.
- Not a sanitiser: it does not make untrusted HTML safe to render.
- Entities without a closing semicolon are not decoded.
Last reviewed November 9, 2026. How we build and test tools.