🔣 HTML Entity Encoder and Decoder
By Shihab Mia · Updated 2026-07-29
Type some text and press Encode.
This HTML entity encoder and decoder converts text to safe HTML entities and back again. Encoding turns characters that have meaning in markup, such as the less-than sign, the ampersand, and quotation marks, into entities like < and & so a browser renders them as literal text rather than treating them as code. Decoding does the reverse, turning entities back into the characters they stand for. Everything runs in your browser, so the text you paste never leaves your device.
What is the HTML Entity Encoder?
HTML entities are short codes that represent a character without typing the character itself. They exist because a handful of characters are reserved: the browser reads a less-than sign as the start of a tag and an ampersand as the start of an entity. If you want those characters to appear on screen as ordinary text, you have to write them as entities instead, for example < for < and & for &. The same trick lets you include characters that are hard to type or that might not survive a particular file encoding, such as a copyright sign, a curly quote, or an em dash.
Every entity comes in three forms. A named entity uses a memorable label, like © for the copyright sign. A decimal numeric entity uses the character's Unicode code point in base ten, like © for the same sign. A hexadecimal numeric entity uses the code point in base sixteen, like ©. All three produce the identical character on screen. Named entities read more clearly, but only a few hundred names are defined in the HTML5 spec, so numeric entities are the universal fallback for anything else, including emoji, less common accented letters, and mathematical or arrow symbols.
When you encode, you usually only need to escape the five characters that are genuinely special in HTML: the ampersand, the less-than and greater-than signs, and the two kinds of quotation mark. Encoding more than that is optional. This tool can also encode every non-ASCII character, which is handy when a system, a legacy database column, an email template, or a strict data feed can only safely transmit plain ASCII bytes. In that mode, an accented letter like e-acute or a currency symbol like the euro sign is rewritten as a numeric entity so it survives intact through systems that would otherwise mangle it.
HTML entity encoding is not the same thing as URL encoding (percent-encoding) or JavaScript string escaping, even though all three exist to make special characters safe in a particular context. URL encoding replaces unsafe bytes with a percent sign followed by two hex digits, for characters that would otherwise break a URL, such as a space or a question mark. JavaScript escaping uses backslash sequences like \n or \u00e9 inside a JS string literal. Using the wrong one for the context, for instance HTML-encoding a value that is actually being inserted into a URL query string, does not make the output safe and can even break it. Pick the encoding that matches where the text is actually going: HTML body text, an HTML attribute, a URL, or a script.
When you decode, order matters: the ampersand must be turned back last, or you risk double-decoding a string like &lt; into < instead of leaving it as <. This tool uses the browser's own HTML parser to decode, so all named entities (from & to obscure ones like ∴), decimal entities, and hexadecimal entities resolve correctly in a single pass, including the handful of legacy named entities browsers still accept without a trailing semicolon for backward compatibility with very old pages.
When to use it
- Displaying example HTML or code on a web page, in documentation, or in a blog post so the tags show as text instead of rendering as live markup.
- Escaping user-supplied text before inserting it into a page template, to help prevent broken layout and reduce injection risk.
- Cleaning up content pasted from a CMS, a Word document, or an email where characters arrived as raw entities like &amp; or smart quotes as &#8217;.
- Encoding accented names, currency symbols, or other non-ASCII characters into ASCII-safe entities for an older system, a CSV export, or a strict data feed.
- Preparing a code snippet for a static site generator, README, or forum post where < and > would otherwise be swallowed as tags.
- Auditing or debugging why a page shows literal &nbsp; or &amp; text instead of a space or an ampersand, by decoding the raw source to see what it actually contains.
How to use the HTML Entity Encoder
- Choose Encode to turn text into entities, or Decode to turn entities back into text.
- Paste or type your content into the input box.
- For encoding, optionally tick "Encode all non-ASCII" and choose whether to prefer named entities.
- Read the result, then press Copy to put it on your clipboard. Use Swap to feed the result back as new input.
Formula & method
Worked examples
Showing a snippet of HTML as text: <a href="x">Go</a>
- Escape each reserved character left to right.
- < becomes < and > becomes >
- The double quotes become "
- There is no & in the snippet, so nothing else changes.
Result: <a href="x">Go</a>
Encoding "(c) 2026 Cafe" (with an accented e) with non-ASCII encoding and named entities on.
- The copyright sign is code point 169, which has the name ©
- The space and digits are plain ASCII, so they stay as they are.
- The accented e in Cafe is code point 233 (hex E9) with no common name, so it becomes é
Result: © 2026 Café
Decoding 5 > 3 && 2 < 4 back to plain text.
- > resolves to >
- < resolves to <
- Each & resolves to a single &
Result: 5 > 3 && 2 < 4
A comment box stores raw user input containing a script tag, and you need to render it safely as visible text.
- Input: <script>alert(1)</script>
- The < and > around both tags become < and >
- No ampersands or quotes are present, so nothing else changes.
- The browser now displays the tag as text instead of running it as a script.
Result: <script>alert(1)</script>
The five reserved HTML characters and their entities
| Character | Named entity | Decimal | Hex |
|---|---|---|---|
| & | & | & | & |
| < | < | < | < |
| > | > | > | > |
| " | " | " | " |
| ' | ' or ' | ' | ' |
Common symbol and whitespace entities
| Symbol | Named entity | Decimal | Hex |
|---|---|---|---|
| copyright | © | © | © |
| registered | ® | ® | ® |
| trademark | ™ | ™ | ™ |
| euro | € | € | € |
| pound | £ | £ | £ |
| yen | ¥ | ¥ | ¥ |
| non-breaking space | |   |   |
| en dash | – | – | – |
| em dash | — | — | — |
| left double quote | “ | “ | “ |
| right double quote | ” | ” | ” |
| bullet | • | • | • |
| degree | ° | ° | ° |
HTML entity encoding vs other text-encoding schemes
| Scheme | Used for | Example of a space character | Typical context |
|---|---|---|---|
| HTML entity | Characters reserved in HTML markup | &nbsp; (non-breaking space) | HTML body text and attributes |
| URL / percent-encoding | Characters unsafe in a URL | %20 | Query strings, path segments |
| JavaScript string escape | Characters unsafe in a JS string literal | \u0020 | JS source code, JSON strings |
| Base64 | Binary data as printable ASCII text | not applicable, whole payload is re-encoded | Attachments, data URIs, tokens |
Common mistakes to avoid
- Encoding the ampersand twice. If you encode text that already contains entities, &copy; turns into &amp;copy; and shows on the page as © instead of the symbol. Decode first, or only encode raw text.
- Using ' in old HTML. The named entity ' for the apostrophe is valid in XHTML and HTML5 but not in HTML4. For the widest compatibility, the numeric ' is safer, which is why this tool outputs '.
- Forgetting the trailing semicolon. An entity must end with a semicolon, like &. Writing & without it may still render in some browsers but is technically invalid and can break parsing.
- Relying on encoding alone for security. Escaping the five reserved characters helps prevent broken markup, but safe output depends on context (HTML body, attribute, URL, script). Use the right encoding for each context, not just one blanket pass.
- Confusing HTML encoding with URL encoding. A space becomes &nbsp; in HTML but %20 in a URL. Applying HTML entity encoding to a value that is being placed in a query string does not make it URL-safe, and vice versa.
- Encoding inside a <script> or <style> block. Entities are an HTML markup rule, not a JavaScript or CSS one. Text inside a script or style tag is not parsed for entities, so &amp; there stays as the literal characters &amp; instead of decoding to &.
Glossary
- HTML entity
- A code that represents a single character, written as an ampersand, a name or number, and a semicolon, such as & or &.
- Named entity
- An entity that uses a human-readable label, like © or . Only a few hundred names are defined in the HTML5 spec.
- Numeric entity
- An entity that uses the character's Unicode code point, in decimal (©) or hexadecimal (©).
- Reserved character
- A character that has special meaning in HTML and must be escaped to appear as text: & < > " and '.
- Code point
- The numeric identifier Unicode assigns to a character, for example 169 for the copyright sign.
- Character reference
- The formal name in the HTML spec for what most people call an entity: a marker that stands in for a single character.
- Context-sensitive escaping
- The security practice of choosing the correct encoding (HTML, attribute, URL, or JS) based on exactly where a value is inserted, rather than applying one encoding everywhere.
- ISO 8859-1
- An older single-byte character set that covers Western European letters and symbols; many classic named HTML entities map to characters from it.
Frequently asked questions
What does an HTML entity encoder do?
It converts characters that have special meaning in HTML, such as <, >, &, and quotes, into entity codes like < and & so they display as literal text instead of being read as markup. It can also turn entities back into plain characters.
Which characters must I escape in HTML?
Five characters are reserved: the ampersand (&), the less-than sign (<), the greater-than sign (>), the double quote ("), and the single quote ('). Escaping these covers most cases; other characters are optional unless you are targeting ASCII-only output.
What is the difference between named and numeric entities?
A named entity uses a label, like ©, while a numeric entity uses the character code, like © (decimal) or © (hex). They produce the same character; named entities are easier to read but limited in number, so numeric entities cover everything else.
How do I decode HTML entities back to text?
Switch this tool to Decode and paste the text. It resolves named, decimal, and hexadecimal entities in one pass using the browser parser, so &copy; becomes the copyright sign and &amp; becomes a single ampersand.
Is it safe to paste sensitive text here?
Yes. All encoding and decoding happens locally in your browser with plain JavaScript. Nothing is uploaded, sent over the network, or stored, so the text never leaves your device.
Does this prevent cross-site scripting (XSS)?
Escaping the reserved characters reduces the risk of injected markup, but full protection depends on encoding for the correct context (HTML body, attribute, URL, or script) and other defenses such as a content security policy. Treat this tool as one helpful step, not a complete security solution.
Is HTML entity encoding the same as URL encoding?
No. HTML entity encoding uses codes like &amp; for characters reserved in markup, while URL encoding (percent-encoding) uses codes like %20 for characters unsafe in a URL. Use the one that matches where the text is actually going.
What is and why does it show up so often?
is the non-breaking space entity, code point 160. It looks like a normal space but prevents a line break at that point, and it also survives HTML whitespace collapsing where a plain space sometimes would not, which is why editors and CMS tools insert it frequently.
Why did copying text from Word or a CMS produce weird entities like &#8217;?
Word and many CMS editors replace straight quotes and hyphens with typographic versions, such as a curly apostrophe (code point 8217) or an em dash. When that content is later HTML-escaped, those characters appear as their entity codes. Decoding once resolves them back to normal punctuation.
Do I need to encode every character, or just the reserved ones?
For text destined for a modern, UTF-8 page, encoding just the five reserved characters is enough. Encode all non-ASCII characters only when the destination system, file format, or feed cannot reliably handle UTF-8 and needs plain ASCII with entities standing in for everything else.