HTML Entity Encoder Decoder guide
Escape text so it displays literally inside HTML, or turn a string full of entities like " and ’ back into readable characters. Output updates as you type.
Why HTML needs entities
HTML uses a few characters as syntax. A < starts a tag, an & starts an entity, and quotes delimit attribute values. If you want those characters to appear as text, for example to show a code sample, write a math expression like 5 < 10, or put a company name like AT&T in an attribute, they have to be escaped as entities so the browser does not mistake them for markup.
An entity is either named (&, <, ©, ) or numeric, in decimal (é) or hexadecimal (é). HTML5 defines more than 2,000 named entities, but in practice you only need five for escaping.
The five characters that matter
& becomes &. This one is always first, because every other entity starts with an ampersand. < becomes < and > becomes >. " becomes " and ' becomes ' (the named ' was not part of HTML 4, so the numeric form is the safest choice for old email clients).
Strictly, text content only requires & and < to be escaped, and attribute values only require & and the quote character used around them. Escaping all five everywhere is simpler and never wrong, which is what the encoder does.
Named entities beyond these five are optional on a UTF-8 page. You can type ©, —, or é directly, and they are smaller and easier to read in source than ©, —, and é. The exception is invisible or ambiguous characters, such as the non-breaking space ( ) or a soft hyphen (­), where the entity makes your intent visible to the next person editing the file.
Worked example
Input: <a href="/search?q=tom&jerry">Tom & Jerry's "café"</a>. Encoded, every angle bracket, ampersand, and quote is replaced: <a href="/search?q=tom&jerry">Tom & Jerry's "café"</a>. Paste that into a web page and visitors see the original tag as text, instead of a link.
The é is left alone by default because UTF-8 pages display it fine. Tick "Also encode non-ASCII" and it becomes é. That option is useful for systems that corrupt Unicode: some older CMS fields, certain email service templates, and XML feeds with a non-UTF-8 declared encoding.
Click "Use output as input" and the tool switches to decode, turning the encoded string back into the exact original. Round-tripping like that is a quick way to confirm nothing was lost.
Decoding safely
Decoding is done by letting the browser parse the text inside a detached textarea element, which understands every named and numeric entity in the HTML standard but never runs scripts or loads images. That makes it safe to paste untrusted strings, such as scraped content or a suspicious email body, to see what they really say.
Watch for double encoding. If visitors see literal & or " on a live page, or your source contains &amp;, something escaped text that was already escaped. Decode once and check; if entities remain, decode again, then fix the step in your pipeline that escapes twice.
HTML escaping and XSS
Cross-site scripting happens when user input is inserted into a page without escaping, so a comment containing <script> tags runs as code for everyone who views it. Escaping the five characters before inserting text into HTML content or quoted attributes neutralizes that. OWASP lists output encoding as a primary XSS defense.
It only covers those contexts. Inside a <script> block, a style attribute, or a URL like href="javascript:...", HTML entity encoding is not enough and each context needs its own rules. Modern frameworks escape by default; the danger is the escape hatches, such as innerHTML, dangerouslySetInnerHTML, v-html, and set:html. Use those only with trusted or sanitized content.
Common mistakes
Forgetting to escape the ampersand in URLs inside HTML. href="?a=1&b=2" usually works, but &b could be read as an entity in some cases; href="?a=1&b=2" is the correct form.
Using for layout. Non-breaking spaces are for keeping words together, like "10 kg" or "Mr. Smith". For spacing, use CSS.
Confusing HTML encoding with URL encoding. A space in a URL is %20, not . Use the URL encoder for query strings and paths.
How we calculate: sources
Frequently asked questions
What are HTML entities?
Codes that stand for characters, written as &name; or &#number;. < is <, & is &, © is ©, and é is é. They let you show characters that would otherwise be read as HTML markup, or that are hard to type.
Which characters must be escaped in HTML?
In text content, & and < are the essential ones, and > is escaped by convention. Inside attribute values, also escape the quote character you wrap the value in (" as " or ' as '). This encoder handles all five.
Do I need to encode accented letters like é?
Not if your page is served as UTF-8, which almost every modern site is (<meta charset="utf-8">). Tick "Also encode non-ASCII" only for legacy systems, some email templates, or places that mangle Unicode.
Does HTML encoding prevent XSS?
Escaping text before putting it into HTML content or quoted attributes is a core XSS defense, and it is what frameworks like React, Vue, and Astro do automatically. It is not enough inside <script> blocks, URLs (href="javascript:..."), or CSS, which need context-specific encoding.
What is ?
A non-breaking space (U+00A0). It looks like a space but prevents a line break between two words, like "10 kg". Decoding turns it into that character, which can cause surprises when you paste text into code or spreadsheets.
What is the difference between HTML encoding and URL encoding?
HTML encoding makes text safe inside a web page (& becomes &). URL encoding makes text safe inside a URL (a space becomes %20, & becomes %26). Use the URL encoder for query strings.
Is my text kept private?
Everything runs in your browser. Nothing you enter is uploaded to a server or stored by us.