HTML Entity Encoder — Encode Decode HTML Entities Online
Encode plain text to HTML entities or decode HTML entities back to readable text. Supports named entities (& < > " ©) and numeric entities in decimal (&#NNN;) or hexadecimal (&#xHH;) form. 100% client-side — nothing is sent to any server.
What is an HTML entity? An HTML entity is a text stand-in for a character that would otherwise be read as markup or cannot be typed directly. Every entity begins with an ampersand and ends with a semicolon, and comes in two forms: a named reference such as <, or a numeric character reference giving the Unicode code point in decimal (<) or hexadecimal (<). Encoding &, <, > and both quote marks is what stops user text from becoming executable markup.
How to Use the HTML Entity Encoder
- Pick the entity mode first — Named produces readable references for the 30 characters it knows and leaves the rest as UTF-8. Numeric converts every character above code point 127 to a decimal reference for ASCII-only output. Auto escapes the seven structural characters by name and everything non-ASCII numerically.
- Paste your text into the left panel — The character counters above each panel update as you type. Nothing is converted yet — unlike a live formatter, this tool waits for you to choose a direction, so you can change modes before committing.
- Click Encode or Decode — Encode turns plain text into entities; Decode turns entities back into characters. The panel labels flip to match, so Plain Text and HTML Entities always tell you which side you are looking at. The mode buttons only affect encoding — decoding accepts named, decimal and hexadecimal references regardless.
- Use Swap to round-trip a value — Swap exchanges the two panels. Encode, swap, decode, and compare the result against what you started with — the fastest way to confirm that a string survives the trip without losing a character.
- Copy the output — Either the Copy Output button or the small clipboard icon in the output header puts the result on your clipboard. Clear empties both panels and resets the labels.
How Entity Encoding Works
A browser parsing HTML has no way to know whether the < in your text is the start of a tag or a
less-than sign — it can only follow the grammar. Entity encoding removes the ambiguity by replacing the character with
a reference the parser resolves back to a literal at the very end of parsing, after tag boundaries have already been
decided. That ordering is the whole point: an escaped <script> can never open an element,
which is why output encoding, not input filtering, is the primary defence against cross-site scripting.
Three characters must always be escaped in body text — &, < and > —
and both quote characters must be added to that list inside attribute values, since a stray quote closes the attribute
and lets an attacker start a new one. This tool also escapes the forward slash and the backtick, two characters that
appear in defence-in-depth escaping guidance because they can end a tag early or open a template literal in some
legacy parsing contexts.
What each mode actually produces
- Named maps 30 characters: the eight structural ones (
&,<,>, both quotes, backtick, slash and the non-breaking space) plus 22 common typographic and currency symbols such as©,—,€,…and the four arrows. Anything else — accented letters, CJK text, emoji — is left as literal UTF-8, which is correct for any page served with a UTF-8 charset. - Numeric walks the string one UTF-16 code unit at a time. Characters below 128 pass through untouched except the seven structural ones, which become
&,<and so on; every character from 128 upwards becomes a decimal reference. The output is pure ASCII, which is what you want for a legacy pipeline or an email client with an uncertain charset. - Auto is the practical middle: named references for the seven structural characters so the markup stays readable in a diff, numeric references for everything non-ASCII. Note that the apostrophe is emitted as
'rather than'in every mode, because'was never part of HTML 4 and some older parsers do not recognise it.
How decoding behaves
Decoding replaces every named reference it knows, then resolves hexadecimal &#xHH; references, then
decimal &#NNN; ones. Two behaviours are worth knowing. Ampersand references are unwrapped repeatedly,
so a double- or triple-encoded string such as &amp;lt; comes back as a single < in
one click rather than needing several passes — convenient for untangling a value that has been escaped twice by a
pipeline, but it also means the tool cannot preserve a literal & you intended to keep escaped.
And because references are resolved with String.fromCharCode, a numeric reference above U+FFFF — an emoji
written as 😀, for example — does not round-trip correctly. Surrogate-pair references such as
�� do.
HTML Entity Reference
All three forms are interchangeable — a browser resolves <, < and
< to the same character. Note that the hexadecimal form needs the hash as well as the
x: &x3C; without it is not a valid reference and will be shown as literal text.
| Character | Named | Decimal | Hexadecimal | Why it matters |
|---|---|---|---|---|
| & | & | & | & | Starts every reference — escape it first or you double-encode |
| < | < | < | < | Opens a tag; the single most important character to escape |
| > | > | > | > | Closes a tag |
| " | " | " | " | Ends a double-quoted attribute value |
| ' | ' | ' | ' | Ends a single-quoted attribute; ' is avoided for legacy parsers |
| / | / | / | / | Can close a tag early in some contexts |
| ` | ` | ` | ` | Treated as an attribute delimiter by some legacy engines |
| non-breaking space | |   |   | Prevents a line break; invisible, so a frequent cause of failed string comparisons |
| © | © | © | © | Copyright sign |
| ® | ® | ® | ® | Registered trade mark |
| ™ | ™ | ™ | ™ | Trade mark |
| – | – | – | – | En dash, used for ranges |
| — | — | — | — | Em dash |
| … | … | … | … | Ellipsis as one character |
| € | € | € | € | Euro sign |
| ’ | ’ | ’ | ’ | Curly apostrophe pasted in from word processors |
Choosing Between Named and Numeric
For a page served as UTF-8 — which is essentially every page written this century — the honest answer is that you only need to escape the structural characters, and how you spell the rest is a matter of pipeline constraints rather than correctness. A literal é, a literal em dash and a literal Chinese character all render perfectly well. Escaping them adds bytes and makes the source harder to read and search.
Reach for named references when
- A human will read the source in a diff or a template, and
—tells them more than—. - You are hand-editing an HTML email, where a mix of rendering engines makes the widely-supported classics the safe choice.
- The character is one of the thirty this tool knows; there is no named reference for most of Unicode, so it falls back to leaving the character alone.
Reach for numeric references when
- The output must be pure ASCII — a legacy CMS field, a properties file, or a channel whose charset you do not control.
- The text is in a script with no named entities at all: Cyrillic, Arabic, Hindi, Chinese, Japanese, Korean.
- You are debugging and want every character's code point visible, including the invisible ones.
Entity encoding is context-specific, and this page produces the HTML flavour only. Text going into a URL needs percent-encoding, text going into a JavaScript literal needs backslash escaping, and text going into a SQL statement needs a parameterised query — not escaping at all. Applying HTML escaping to a value that ends up in one of those places protects nothing and usually corrupts the value. The Encoder / Decoder covers the other contexts.
Frequently Asked Questions
Named mode covers 30 characters: &, <, >, ", ', the backtick, the slash, , and 22 typographic and currency symbols including ©, ®, ™, €, —, …, the curly quotes and the four arrows. It is not the full HTML5 table of roughly 2,200 names — anything outside that set is left as literal UTF-8, which renders correctly on a UTF-8 page. Numeric mode has no such limit and encodes every character above 127.
Named references are for humans reading the source and for the handful of symbols everyone recognises; numeric references are for machines and for output that must be pure ASCII. If your page declares UTF-8, escaping only the structural characters and leaving accented letters and symbols literal is the smallest, clearest option. Switch to numeric when the text travels through a channel whose character encoding you cannot rely on, such as a legacy CMS field or an HTML email.
It is the core of the defence, but only when applied at output time and for the right context. Escaping the five structural characters prevents user text from becoming a tag or breaking out of an attribute. It does not help if the value lands in a URL inside href, in an inline <script> block, or in a CSS expression — those need their own escaping, and a javascript: URL survives HTML escaping untouched. Escape on output, never store pre-escaped values, and rely on your framework's context-aware templating where you have one.
It resolves them in one click. Ampersand references are unwrapped repeatedly before the other entities are processed, so &amp;lt; and even &amp;amp;lt; come out as a single < without running decode again. The trade-off is that the tool cannot preserve a literal & that you deliberately wanted to stay escaped — if you need exactly one layer removed, decode a short section at a time and check the result.
Numeric references above U+FFFF are the limitation. Decoding uses String.fromCharCode, which only handles a single UTF-16 code unit, so a reference such as 😀 for a grinning face resolves to the wrong character. Written as a surrogate pair — �� — it decodes correctly, and that is also the form numeric encoding produces here. Characters inside the Basic Multilingual Plane, which covers all CJK text and every accented Latin letter, are unaffected.
No network request is made — the mapping tables and both conversions live in JavaScript in your tab. One caveat worth knowing: clicking Encode writes the input panel's contents into the page URL as a query parameter so a conversion can be bookmarked or reloaded. Decode does not. Use Clear before copying or sharing the address if the text was anything you would not paste into a public issue.
They protect against different parsers. HTML entities such as   stop the HTML parser from misreading a character; percent-encoding such as %20 stops the URL parser from misreading one. Neither substitutes for the other, and the same space is   in one and %20 in the other. Use this page for markup and the Encoder / Decoder when the destination is a URL, a Base64 field or a JavaScript literal.
This tool does not convert as you type — it waits for you to press Encode or Decode. That is deliberate, since the same text is valid input in both directions and guessing would be wrong half the time. If you pressed a button and the output still looks identical to the input, the text probably contains no characters this mode escapes: named mode leaves plain ASCII words and unlisted Unicode alone by design.
Use Cases
Showing Code Samples in a Blog Post
A tag pasted into a CMS editor disappears because the browser renders it. Encode the snippet first so <div> survives as visible text rather than becoming an empty element in the published page.
Fixing a Broken Attribute Value
A product name containing an apostrophe or a quote mark truncates a title or alt attribute and leaves stray text in the markup. Encode the value so both quote characters stay inside the attribute.
Untangling Double-Encoded Output
A page is showing &amp; or &lt;br&gt; where text should be. Paste it in and decode to see the original value, which usually reveals which layer of the pipeline is escaping something that was already escaped.
Preparing an ASCII-Only Email Template
Hand-built HTML emails still meet clients that mangle non-ASCII bytes. Numeric mode turns curly quotes, em dashes and accented names into decimal references so the template renders the same everywhere.
Hunting an Invisible Character
Two strings look identical but never compare equal. Encode both in numeric mode and the difference becomes visible — usually a   non-breaking space or a ’ curly apostrophe copied in from a document.
Reading Escaped Content Out of a Database
Legacy applications often store already-escaped text. Decode a sample row to see what the user actually typed, which tells you whether the escaping belongs at storage time or should be moved to output.