HTML Entity Encoder & Decoder
Escape text so it is safe to put inside HTML, or turn entities like & and € back into readable characters.
Runs in your browserNo sign-upNothing uploaded
How to use the HTML Entity Encoder / Decoder
- Choose Encode to escape text, or Decode to turn entities back into characters.
- When encoding, choose which characters to escape: only the HTML-special ones, all non-ASCII characters too, or everything except letters and digits.
- Pick named entities (
é), decimal (é) or hex (é). - Copy the result. When decoding, unknown entities are listed so you can spot typos.
Why escape HTML?
Five characters have special meaning in HTML: & starts an entity, < and > delimit tags, and " and ' close attribute values. If user-supplied text containing them is inserted into a page unescaped, it can break the layout or, worse, inject scripts (cross-site scripting, XSS). Escaping turns them into &, <, >, " and ', which the browser displays as text.
Named, decimal and hex entities
Every Unicode character can be written as a numeric reference: decimal € or hex € for €. Many common characters also have a readable name, like €, © or . Numeric references work everywhere, including XML, which only defines five named entities. Named entities are easier to read in source code.
Do I need to encode non-ASCII characters?
Not if your page is served as UTF-8, which almost every modern site is (<meta charset="utf-8">). Characters such as é, ü or 日本 can be written directly. Encoding them is useful for legacy systems, email templates, or when a pipeline mangles non-ASCII text.
Escaping is context-specific
HTML entity escaping protects text placed in element content and quoted attributes. It is not enough for values inside <script> blocks, inline event handlers, CSS or URLs, which each need their own encoding. Prefer your framework's auto-escaping (React, Vue, Jinja, Blade) over manual string building.
Frequently asked questions
Which characters must be escaped in HTML?
& and < are essential. In attribute values, also escape the quote character you used. Escaping all five (& < > " ') is the safe default.What is &nbsp;?
Why does &copy2024 decode to ©2024?
©, & and <, even without the trailing semicolon. This decoder follows the same rule. Always write the semicolon in your own HTML.Is the apostrophe &apos; or &#39;?
' is valid in HTML5 and XML but not in HTML 4, so numeric ' or ' is the most compatible choice and what this encoder outputs.