Encode and decode HTML entities safely
The HTML entity encoder and decoder converts text into a form that can be placed inside HTML without breaking the page — and turns entity-filled HTML back into readable text. Encoding replaces characters such as <, > and & with <, > and &; decoding does the reverse for every entity format.
Use it to show code snippets in a blog post, put user-supplied text into a template, prepare content for an email that must stay ASCII-only, or clean up text scraped from a page that is full of and ’. Encoding can use named entities like é, decimal references like é or hexadecimal references like é.
Decoding follows the HTML standard exactly, so all 2,000+ named entities and numeric references are understood. Everything runs locally in your browser — nothing you paste is sent to a server.
How to use the HTML Entity Encoder / Decoder
- Choose Encode or Decode.
- For encoding, choose whether to convert only the HTML special characters or also every non-ASCII character such as é, ₹ and emoji.
- Pick the Entity format: named entities where they exist, decimal, or hexadecimal.
- Untick Encode quotes if the text goes between tags rather than inside an attribute value.
- Paste your text; the result updates live. Use Copy, or Swap to feed the result back in the other direction.
HTML Entity Encoder / Decoder features
Three entity formats
Named entities (with a decimal fallback when a character has no name), decimal &#…; and hexadecimal &#x…; references.
Standards-exact decoding
Decoding uses the browser’s own HTML parser in a text-only context, so it handles every named entity, legacy forms without a semicolon and numeric references exactly as browsers do — without running any markup.
Emoji-safe
Characters outside the Basic Multilingual Plane, such as 😀, are encoded as one reference (😀), not as two broken surrogate halves.
ASCII-only output
The non-ASCII option produces pure ASCII HTML that survives old systems, legacy email gateways and databases with the wrong character set.
Double-encoding warnings
If decoded text still contains entities like &lt;, the tool points it out and offers to decode again.
The five characters you must escape in HTML
Only a handful of characters have special meaning in HTML. < starts a tag and & starts an entity, so both must always be escaped in text. > is escaped for symmetry and safety. Inside attribute values, the quote character that delimits the value must also be escaped — " for double quotes and ' for single quotes. This tool uses ' rather than ' because ' was not part of HTML 4 and some old clients do not recognise it.
Escaping user input this way is the core defence against cross-site scripting (XSS) when you insert text into HTML. It is not enough for other contexts: text inside a <script> block, a URL or CSS needs its own escaping — for URLs use the URL Encoder.
| Character | Named | Decimal | Hex | Why |
|---|---|---|---|---|
& | & | & | & | Starts an entity |
< | < | < | < | Starts a tag |
> | > | > | > | Ends a tag |
" | " | " | " | Closes double-quoted attributes |
' | ' (HTML5) | ' | ' | Closes single-quoted attributes |
Frequently used HTML entities
| Character | Entity | Number | Name |
|---|---|---|---|
| (space) | |   | Non-breaking space |
| © | © | © | Copyright |
| ® | ® | ® | Registered trademark |
| ™ | ™ | ™ | Trademark |
| € £ ¥ | € £ ¥ | € £ ¥ | Currency signs |
| ₹ | — | ₹ | Indian rupee (no named entity) |
| – — | – — | – — | En and em dash |
| “ ” ‘ ’ | “ ” ‘ ’ | “ … | Curly quotes |
| × ÷ ≠ ≤ ≥ | × ÷ ≠ ≤ ≥ | × … | Maths symbols |
HTML Entity Encoder / Decoder FAQ
What is an HTML entity?
An HTML entity is a piece of text that starts with & and ends with ; and stands for one character, such as < for < or © for ©. Browsers replace entities with the character when they display the page.
Do I need to encode é, ü or ₹ in modern HTML?
Not if your page is saved and served as UTF-8 with <meta charset="utf-8">, which is the norm today. Encode only the special characters. Use the non-ASCII option when the text must pass through a system that is not UTF-8 safe.
How do I decode HTML entities?
Choose Decode and paste the text. Every named, decimal and hexadecimal entity is converted back to its character, exactly as a browser would display it. The HTML entity decoder treats tags as plain text, so nothing is executed.
Why is &nbsp; still showing in my text?
The text was probably encoded twice, so it contains &nbsp;. Decode it, then use “Decode again” when the tool flags it.
Is encoding HTML entities enough to prevent XSS?
It is the right defence for text placed between tags or inside quoted attribute values. Inside JavaScript, URLs, CSS or unquoted attributes you need context-specific escaping — and a templating engine that escapes automatically is always the safest choice.
Is the text I paste kept private?
Yes. Encoding and decoding run entirely in your browser. Nothing is uploaded or stored.