How to encode or decode HTML entities
- Choose Encode or Decode.
- Type or paste into Text or HTML to encode (or Text with entities to decode). The page opens with an example already filled in.
- When encoding, pick an Entity format (Named, Decimal or Hex) and a Scope (Special characters only, Special and non-ASCII, or All characters).
- Click Copy, or Swap to move the result back into the input and flip the mode to check it round-trips.
- Type in Filter the table to look up an entity by character, name, number or description.
How the conversion works
An HTML character reference starts with an ampersand and ends with a semicolon, as defined in the HTML Standard. Encoding replaces each character in your chosen scope with its name (such as ©) when the format is Named and the character has one, and otherwise with its Unicode code point in decimal (©) or hex (©). Decoding uses your browser's own HTML parser, so it understands every named reference in the standard, more than 2,000 of them, plus decimal and hex forms.
Worked example
The default input is:
<p class="note">Tom & Jerry's café costs €5 < $6</p>
With Named format and Special characters only, the output is:
<p class="note">Tom & Jerry's café costs €5 < $6</p>
Switching Scope to Special and non-ASCII also turns the accented letter and the euro sign into names:
<p class="note">Tom & Jerry's café costs €5 < $6</p>
Limits and edge cases
- Named format writes a single quote as
', which is valid in HTML5 and XML but not in HTML 4. Choose Decimal to get'instead. - Characters without a name, such as emoji, fall back to decimal numbers in Named format. An unpaired surrogate is written as the replacement character
�. - Decoding follows browser rules: a name such as
©without its semicolon still decodes, an unknown name such as&bogus;stays as typed, and an invalid number becomes the replacement character. - Entities are not decoded inside CDATA sections or inside script and style elements, so do not encode text that will go there.
- Encoding is not a sanitizer. It protects text placed in the page body or in a quoted attribute, as the FAQ below explains.
Frequently asked questions
Which characters must be escaped in HTML?
In element text, escape the less-than sign and the ampersand. In a quoted attribute value, escape the ampersand and the quote character that wraps the value. Escaping the greater-than sign and both quote marks as well is harmless, and it is the usual habit, which is why the Special characters only scope covers all five.
What is the difference between named, decimal and hex entities?
All three produce the same character in a browser. Named entities such as © are easy to read but exist only for some characters. Decimal (©) and hex (©) entities use the Unicode code point and work for every character, including emoji.
Does encoding HTML entities prevent XSS?
It stops injected text from being read as markup when you place it in element text or in a quoted attribute. It is not enough inside script or style blocks, in URL attributes such as href, or in unquoted attributes, which each need their own escaping. The OWASP XSS Prevention Cheat Sheet explains each context.
Why does the decoded look like an ordinary space?
A non-breaking space is the character U+00A0. It renders like a space, but browsers do not collapse it or break a line at it. The decoded output contains the real character, so it looks like a space even though it is not a normal one.
Related tools: the URL encoder and decoder for percent-encoding, the HTML beautifier to tidy markup, and the Markdown preview to see rendered output. For security guidance, read the OWASP XSS Prevention Cheat Sheet.