Free HTML Entity Encoder and Decoder
Escape the five characters that break HTML, or decode &-style references from any page back into plain text.
What is a HTML Entity Encoder and Decoder?
An HTML entity encoder rewrites characters that have a special meaning in HTML, such as the less-than sign and the ampersand, as character references like < and &. A decoder turns references back into the characters they stand for.
This tool uses the full table of 2,231 named character references from the WHATWG HTML Standard, through the open-source entities library. It offers three ways to encode: escape only the five special characters, encode with named references where they exist, or encode with numeric hex references that are also valid in XML. Decoding follows the same rules browsers use, including the old forms written without a semicolon.
Key Features
Minimal Escaping by Default
Escape only rewrites the ampersand, less-than, greater-than and both quote marks, and leaves accents and emoji as UTF-8. That is the safe choice for text going into HTML or an attribute.
Every HTML5 Name Decoded
All 2,231 named references decode, from & to ’, not just the dozen most common. Hex and decimal numeric references decode too.
Decodes Like a Browser
A bare ampersand stays as typed, and legacy names such as © without a semicolon still decode. The result matches what a browser would show for the same source.
XML-Safe Numeric Mode
Numeric mode writes references such as © that every HTML and XML parser accepts. Use it for RSS feeds, SVG and email templates.
Your Markup Stays Local
Encoding and decoding run in your browser, so draft content, templates and scraped pages aren’t sent to a server.
Emoji and Rare Symbols Covered
Characters above U+FFFF, including emoji, encode as a single numeric reference such as 😀. They decode back to the same character, not two broken halves.
Perfect for everyone
- Front-end developers escaping user content
- Content editors fixing CMS output
- Email developers building HTML templates
- Scrapers cleaning extracted text
How to Use the HTML Entity Encoder and Decoder
Choose how to encode or decode, paste, and copy the result.
Pick a Mode
Choose Escape only for text going into HTML, Named for readable references like é, Numeric for XML-safe output, or Decode to turn references back into characters.
Paste the Text or Markup
Paste a snippet, a paragraph or a whole template. Inputs up to 200,000 characters convert instantly, and line breaks are kept.
Check the Converted Text
The result updates with every keystroke. When decoding, look out for references that stayed as typed, since an unknown or misspelled name isn’t a character.
Paste It Back Where It Belongs
Copy escaped text into your template, attribute or email, or copy decoded text into a document or spreadsheet. The In and Out counts show how much escaping added.
Real Input and Output
These rows were converted by this tool, and each answer is its exact output. Guess the result first, then reveal it.
“<a href="/search?q=1&lang=en">Café</a>”
“5 > 3 & 2 < 4”
“Café crème — 5 €”
“It’s 9 > 8”
“<p>© 2026 Tom & Jerry’s</p>”
“Thanks 😀”
“Fish & Chips — £9 🐟”
“<script>alert(1)</script>”
“AT&T © 2026”
“¬anentity; &amp;”
Character References Worth Knowing
A handful of references cover most real HTML. These entries explain each one and the parsing rules around them.
Ampersand Is &
The ampersand starts every reference, so a literal one in text or a URL attribute is written &. It is the first character to escape and the most often forgotten.
“How is a literal ampersand written?”
Less-Than Is <
The less-than sign opens a tag, so text that contains one must escape it or the browser starts parsing markup. This is the core of preventing script injection.
“How is the less-than sign written?”
Greater-Than Is >
The greater-than sign closes a tag. Escaping it isn’t strictly required in text, but escaping both brackets keeps output readable and consistent.
“How is the greater-than sign written?”
Quotes Inside Attributes
A double quote inside a double-quoted attribute value ends it early, so it becomes ". A single quote becomes ' or ' inside single-quoted values.
“How is a double quote written in an attribute?”
Non-Breaking Space Is
is U+00A0, a space that never wraps to a new line. It is the most common reference in copied web text and often hides in data.
“Which code point is ?”
Hex and Decimal Numeric References
é and é both mean é: the first is hexadecimal, the second decimal. Any code point can be written this way, emoji included.
“What is ©?”
Named References Are Case-Sensitive
É is É and é is é, and & is a separate legacy name. Spell names exactly, or they stay as plain text.
“Is É the same as é?”
Some Names Work Without a Semicolon
For compatibility, browsers still decode about a hundred old names such as © and & without their semicolon. Always write the semicolon; never rely on this.
“Does © 2026 show ©?”
XML Has Only Five Built-In Names
XML predefines just &, <, >, " and '. Names like é break an XML or RSS parser, so use numeric references there.
“Is valid in plain XML?”
Unknown Names Stay as Text
A misspelled or invented name isn’t an error in HTML; it is shown literally. That is why ©right; displays as ©right; and not as a symbol.
“What does ©right; show?”
Which Encoding Mode to Use
The right mode depends on where the text is going, not on the text itself.
Escape Only for HTML Text and Attributes
Rewriting just the five special characters is enough to make text safe inside HTML elements and quoted attributes. Accents and emoji stay readable in the source.
Named for Readable Source
Named references like é and — show what the character is when you read the source. They also encode punctuation such as = and /, so the output is long.
Numeric for XML, RSS and SVG
XML parsers only know five names, so feeds and SVG files need numeric references for anything else. Numeric mode writes those for every non-ASCII character.
Numeric for ASCII-Only Channels
Some legacy email systems and databases can’t store UTF-8. Numeric references keep every character as plain ASCII until the HTML is rendered.
Decode for Scraped and Exported Text
Text taken from HTML, RSS or a CMS export often still carries & and '. Decoding turns it into clean text for documents and spreadsheets.
Not for JavaScript or URLs
Entities only work in HTML and XML. Inside a script string use JavaScript escapes, and inside a link use percent-encoding instead.
Escape Only for JSON Inside HTML
Text placed in a data attribute and later read by JavaScript needs its quotes and brackets escaped. Escape only covers exactly those characters without bloating the rest.
Decode Before Counting Characters
A meta description stored with & and " looks longer than it renders. Decode it first to measure the length a search engine will actually show.
Escaping Mistakes That Cause Bugs
Most entity bugs are either double escaping or escaping in the wrong place.
Double Escaping
Escaping already escaped text turns & into &amp;, which shows up on the page as a literal &. Escape once, at output, and store raw text.
Escaping Isn’t Sanitising HTML
Escaping makes text display as text. If you need to allow some tags, such as bold and links, use an HTML sanitiser instead of selectively unescaping.
Unquoted Attributes
Escaping protects quoted attribute values, but an unquoted value can be broken by a space. Always quote attributes in templates.
Named References in XML
or é in an RSS feed makes the whole feed fail to parse. Switch to numeric mode for anything that isn’t HTML.
Forgetting the Ampersand in URLs
Query strings in href attributes contain &, which should be & in the HTML source. Validators flag it, and some names after & can be misread as references.
Decoding Untrusted HTML Into a Page
Decoding <script> produces a working script tag. Never insert decoded text back into a page as HTML; insert it as text.
Spot Double Escaping by Its Pattern
Seeing &amp; or &lt; in a page is the signature of escaping twice. Decode once here; if the result still contains references, find the second escape in your pipeline.
Non-Breaking Spaces Hiding in Data
Decoded becomes U+00A0, which looks like a space but isn’t one to code. Trim and split functions miss it, so replace it with a normal space after decoding.
Everyday Entity Jobs
Entities appear wherever text and HTML meet.
Showing Code on a Web Page
Escape a snippet of HTML before putting it in a blog post or docs page, so readers see the tags instead of the browser rendering them.
Cleaning Scraped Text
Text extracted from web pages often contains and ’. Decode it before analysis so word counts and searches work on real characters.
Fixing CMS Output
When a CMS shows &amp; or " on the live site, decode the stored value here to see how many times it was escaped.
Building HTML Email Templates
Encode symbols such as ©, ™ and curly quotes as numeric references so they survive email clients with poor UTF-8 handling.
Writing RSS and Sitemap Files
Titles with ampersands or accents must be XML-safe. Numeric mode gives output any feed reader accepts.
Reviewing Escaped Payloads
Security reviews often meet escaped markup in logs or bug reports. Decode it to read what was submitted, without letting it run.
Preparing Attribute Values
Escape a product name with quotes or an ampersand before putting it in an alt or title attribute in a hand-written template.
Comparing Text Across Systems
A product name exported from a CMS may read Tom & Jerry while the database says Tom & Jerry. Decode both to compare the real values before deduplicating.