HTML entity encoder and decoder
Encode text to named or numeric HTML entities and decode them back, with a minimal mode that escapes only the five characters HTML actually requires.
- Runs in your browser
- Nothing you enter is sent
- Free, no account
62 characters
88 characters
- Entities written
- 7
- Size change
- +26 chars
Minimal mode escapes only & < > " ' — the characters that can break out of element text or an attribute. Everything else, including accents and emoji, is left as literal UTF-8, which is what a modern page wants.
| Char | Named | Decimal | Hex | Description |
|---|---|---|---|---|
| " | " | " | " | Double quotation mark |
| & | & | & | & | Ampersand |
| ' | ' | ' | ' | Apostrophe / single quote |
| < | < | < | < | Less-than sign — opens a tag |
| > | > | > | > | Greater-than sign — closes a tag |
| |   |   | Non-breaking space | |
| ¡ | ¡ | ¡ | ¡ | |
| ¢ | ¢ | ¢ | ¢ | |
| £ | £ | £ | £ | Pound sign |
| ¤ | ¤ | ¤ | ¤ | |
| ¥ | ¥ | ¥ | ¥ | |
| ¦ | ¦ | ¦ | ¦ | |
| § | § | § | § | |
| ¨ | ¨ | ¨ | ¨ | |
| © | © | © | © | Copyright sign |
| ª | ª | ª | ª | |
| « | « | « | « | Left double angle quotation mark |
| ¬ | ¬ | ¬ | ¬ | |
| | ­ | ­ | ­ | Soft hyphen — an invisible optional break point |
| ® | ® | ® | ® | Registered trademark |
| ¯ | ¯ | ¯ | ¯ | |
| ° | ° | ° | ° | Degree sign |
| ± | ± | ± | ± | |
| ² | ² | ² | ² | |
| ³ | ³ | ³ | ³ | |
| ´ | ´ | ´ | ´ | |
| µ | µ | µ | µ | |
| ¶ | ¶ | ¶ | ¶ | |
| · | · | · | · | |
| ¸ | ¸ | ¸ | ¸ | |
| ¹ | ¹ | ¹ | ¹ | |
| º | º | º | º | |
| » | » | » | » | Right double angle quotation mark |
| ¼ | ¼ | ¼ | ¼ | |
| ½ | ½ | ½ | ½ | |
| ¾ | ¾ | ¾ | ¾ | |
| ¿ | ¿ | ¿ | ¿ | |
| À | À | À | À | |
| Á | Á | Á | Á | |
| Â | Â | Â | Â |
How to encode and decode entities
- Choose Encode to turn characters into entities, or Decode to turn entities back into characters.
- Pick the entity style: named (
—), decimal (—) or hexadecimal (—). - Choose how much to escape. Only special characters is the right answer for almost every modern page.
- Copy the result, or use the reference table to look up a single character.
Which characters actually need escaping
Fewer than people think. HTML only needs escaping where a character would otherwise be read as markup, and that depends on where the text sits.
| Context | Must escape | Why |
|---|---|---|
| Element text | & and < | < opens a tag; & starts an entity |
| Double-quoted attribute | & and " | The quote would close the attribute early |
| Single-quoted attribute | & and ' | Same reason |
| Unquoted attribute | Almost everything | Do not use unquoted attributes with dynamic values |
Most libraries escape all five of & < > " ' regardless of context, because it is
cheap and it stops a value being moved from one context to another later. That is what minimal mode
does here.
Named, decimal or hexadecimal?
All three produce the same character. Named references are readable — tells you
more than   — but there are over 2000 of them, only HTML defines them (XML knows
just five), and older parsers disagree on the edges. Numeric references work everywhere and need no
lookup table. Hexadecimal is the usual choice when you are copying a code point straight out of the
Unicode charts, where they are written as U+2014.
If your page is served as UTF-8, which it should be, the best answer for most characters is neither:
just write the character. — is one byte cheaper than —, easier to
read in source, and searchable in your editor.
Entities you will actually meet
| Character | Named | Numeric | Notes |
|---|---|---|---|
| & | & | & | Escape it first, or you will double-encode everything else |
| < | < | < | The one that actually opens a tag |
| > | > | > | Not strictly required in text, escaped by convention |
| " | " | " | Required inside double-quoted attributes |
| ' | ' | ' | ' is HTML5 and XML; older HTML only had the numeric form |
| non-breaking space | |   | Prevents a line break; not the same character as a normal space |
| — | — | — | Em dash |
| – | – | – | En dash, for ranges |
| … | … | … | A single ellipsis character, not three dots |
| © | © | © | |
| € | € | € |
Escaping is not the whole of XSS defence
HTML escaping stops text being reinterpreted as markup, which handles the classic
<script> injection into element text. It does not protect other contexts. A value
dropped inside a <script> block needs JavaScript string escaping; a value used as an
href needs a scheme allowlist (javascript: URLs are not markup and survive
HTML escaping untouched); a value inside a style attribute needs CSS escaping. Use a
templating engine that knows the context, and treat this tool as a debugging aid rather than a security
control.
Astral characters and emoji
Characters above U+FFFF are stored in JavaScript as two UTF-16 code units. Encoders that iterate over
code units split them and produce two meaningless references. This tool iterates by code point, so 😀
becomes the single reference 😀 and decodes back to the same emoji.
Questions
Which characters actually need escaping in HTML?
In element text, only the ampersand and the less-than sign. Inside a double-quoted attribute, the double quote as well. Most people escape ampersand, both angle brackets and both quote characters for safety, which is exactly what the minimal mode does.
Named or numeric entities — which should I use?
Numeric references such as — work in every parser and need no entity table. Named ones such as — are more readable. Both are decoded here; pick whichever your codebase already uses.
Does escaping HTML make my page safe from XSS?
Escaping is necessary but not sufficient. It stops text being read as markup, but a value placed inside a script block, an inline event handler or a URL attribute needs its own context-specific escaping too.
How are emoji and other astral characters handled?
They are treated as whole code points, not as UTF-16 halves, so an emoji becomes a single numeric reference like 😀 and round-trips back to the same character.