HTML Entity Encoder & Decoder

Encode or decode HTML character references

Choose Encode to escape characters that can be interpreted as HTML structure, or Decode to turn named and numeric character references back into text. The swap button sends the result into the other direction, which makes one-layer round-trip checks immediate.

Everything runs in your browser. Nothing is uploaded, and input is deliberately kept out of the page address.

The characters that change HTML

An ampersand begins a character reference and a less-than sign can begin a tag. Those two characters therefore need escaping when untrusted data is inserted as HTML text. A greater-than sign is commonly escaped too, even though it is less often ambiguous.

Quotation marks matter inside attributes. If a value appears in title="...", an unescaped double quote can end the attribute; a single-quoted attribute has the corresponding problem with an apostrophe. The tool encodes both quote styles by default, and lets you turn that off when you are working only with a text node.

Named and numeric references

HTML offers several ways to write the same character. The ampersand can be written as the named reference &, decimal &, or hexadecimal &. Named references are easier for people to recognize; numeric references can represent any Unicode code point.

The encoder always emits a trailing semicolon. HTML supports some legacy names without one, but their interpretation depends on context and the characters that follow. Explicit semicolons avoid those edge cases.

Unicode does not normally need escaping

Modern HTML should be UTF-8, so accents, non-Latin scripts and emoji can appear directly in source. Encoding every non-ASCII character usually makes a document harder to read without improving compatibility.

For an ASCII-only transport or legacy system, enable Encode non-ASCII characters. The tool works by Unicode code point, so an emoji becomes one numeric reference rather than two broken UTF-16 surrogate references.

Decoding follows the browser

HTML defines a large named-character table plus historical parsing rules, including longest-prefix matching and a limited set of semicolonless names. The decoder uses the browser’s own detached HTML parser instead of maintaining a smaller approximation of that table.

Decoding is one pass. For example, decoding < produces the literal text <, not a less-than sign. That preserves layers and avoids repeatedly transforming data until it unexpectedly becomes markup.

Escaping is context-specific

HTML entity encoding is not a general-purpose sanitizer. It is useful when data should be displayed as text in an HTML text node or, with the matching quote escaped, in a quoted attribute. JavaScript strings, CSS values and URLs each have different syntax and require their own encoding and validation.

If users are allowed to submit some HTML markup, use a maintained allowlist sanitizer rather than selectively replacing a few characters. If they are not allowed to submit markup, insert their data through a text API such as textContent whenever possible; the browser will treat it as text without parsing it as HTML.

Frequently asked questions

What is an HTML entity?

The precise HTML term is a character reference: source text such as &, & or & that the HTML parser turns into a character. “Entity” is the common informal name, especially for named references.

Which characters should be encoded?

In ordinary HTML text, & and < are the essential characters to escape; encoding > is also common and harmless. Inside a quoted attribute, encode the quote character used around the value as well. This tool encodes both quote styles by default.

What is the difference between named, decimal and hexadecimal references?

They are different spellings for a character. An ampersand can be &, & or &. Named references are readable when a familiar name exists; numeric references can represent any Unicode code point.

Do named references need a semicolon?

Use one. HTML retains a limited set of legacy semicolonless names, but their parsing depends on surrounding characters and context. Always emitting the semicolon is unambiguous and works in every relevant context.

Why did my text become double-encoded?

Encoding & produces &. Encoding that output again must encode its new ampersand, producing &. Decode one layer at a time, or make sure a template or framework is not escaping a value that was already escaped.

Should I encode every non-ASCII character?

Usually no. A correctly declared UTF-8 HTML document can contain accents, non-Latin scripts and emoji directly. The option exists for systems that require ASCII-only source; numeric references preserve those Unicode code points without changing what the browser displays.

Does entity encoding make arbitrary HTML safe?

Not universally. Escaping rules depend on where data is inserted. HTML text, quoted attributes, URLs, CSS and JavaScript are different contexts with different encoders and validation requirements. Use a maintained sanitizer when you intend to allow some markup rather than displaying all input as text.

Is my text uploaded?

No. Encoding and decoding happen in your browser, and the input is never put in the page address.