HTML Entity Encoder & Decoder
Escape HTML special characters so markup renders as text, or decode entities back into readable characters.
Leave this off for modern UTF-8 pages. Turn it on for legacy templates or email HTML where accents and emoji must be pure ASCII.
How to Use the HTML Entity Encoder & Decoder
- Paste the text you want to escape, or the entity-laden markup you want to read back as plain characters.
- Tick "Encode all non-ASCII characters too" only when the output has to be pure ASCII — accents and emoji then become numeric entities.
- Click "Encode" to escape the reserved characters, or "Decode" to turn named and numeric entities back into text.
- Compare the result panel with your source: the heading tells you whether you are looking at encoded or decoded output.
- Use "Copy result" to paste into your template, or "Clear" to start over.
What Is an HTML Entity Encoder and Decoder?
Five characters carry structural meaning in HTML: the ampersand starts an entity, the angle brackets open and close tags, and the two quote characters delimit attribute values. When any of them appears in content rather than markup, it has to be written as an entity — &, <, >, " and ' — or the browser will parse it as instructions. Escaping those five is the single most reliable defence against broken layouts and stored cross-site scripting.
Order matters more than most people expect. The ampersand must be escaped first, otherwise the ampersands introduced by the later replacements get escaped a second time and < turns into &lt;. Decoding reverses the sequence: numeric and named entities resolve first and & resolves last, so a deliberately escaped &lt; round-trips back to < instead of collapsing into a raw tag. This tool decodes with a plain regular expression and String.fromCodePoint rather than innerHTML, which keeps it safe from script injection and stable during server-side rendering.
Escaping a value for a link instead of for markup? Use the URL encoder and decoder for percent encoding. Binary payloads belong in the Base64 encoder and decoder, and you can clean up copy with the case converter before escaping it.
Frequently Asked Questions (FAQ)
Which characters must be escaped in HTML?
At minimum the ampersand, the less-than and greater-than signs, the double quote, and the apostrophe. The two quote characters only matter inside attribute values, but escaping all five unconditionally is simpler and always safe.
How do I escape HTML characters online?
Paste your text and click "Encode". Every reserved character becomes its entity, with the ampersand handled first so nothing is double-escaped.
How do I decode HTML entities back to text?
Paste the escaped markup and click "Decode". Named entities such as and numeric entities such as © or 😀 are converted back to the characters they represent.
What is the difference between ' and '?
Both represent an apostrophe, but ' was not defined in HTML 4 and older browsers may show it literally. The numeric form ' works everywhere, which is why this tool produces it when encoding.
Should I encode non-ASCII characters as entities?
Usually not. A page served as UTF-8 handles accents, CJK text, and emoji directly, and entities only bloat the file. Turn the option on for legacy systems, older email clients, or pipelines that mangle anything outside ASCII.
Do HTML entities prevent XSS attacks?
Escaping user input before it reaches HTML is a core defence, but it is context-sensitive. Values that land in a URL, in JavaScript, or in a style block need their own escaping rules, so never rely on HTML entities alone.
Does this tool handle emoji and astral characters?
Yes. Encoding iterates by code point rather than by UTF-16 unit, so an emoji becomes one entity such as 😀 instead of two broken surrogate halves, and decoding restores it exactly.
Tips for Escaping HTML Safely
- Tip 1: Escape at output, not at input. Store the original characters in your database and encode when rendering, so the same value can also be used in JSON, email, or a PDF.
- Tip 2: Watch for double escaping. If your page shows &lt; on screen, something escaped an already-escaped string — decode once and fix the pipeline rather than patching the output.
- Tip 3: Use sparingly. It is the right tool for keeping a number next to its unit, but a run of them to fake spacing breaks reflow on small screens.
- Tip 4: Escape your titles and descriptions here before pasting them into the meta tag generator, and switch to the URL encoder and decoder when the value is going into an href rather than into page content.