Tools
HTML entity encoder / decoder
Escape text so it is safe to drop into HTML (turning &, <, >, and quotes into their entity form), or decode named and numeric entities back to readable characters. Decoding is done with a curated entity map and String.fromCodePoint, never by injecting your text into the DOM, so untrusted input can never execute. Everything runs client-side: nothing you paste is uploaded, logged, or stored.
Encode & decode
Escape or unescape HTML entities entirely in your browser.
When to encode HTML entities
Any time user-supplied or dynamic text is placed into an HTML page, the characters that have structural meaning must be escaped first. An unescaped < can be read as the start of a tag, and an unescaped & can begin an entity reference, so a product name like Tom & Jerry or a snippet of code shown as text can corrupt the surrounding markup, or worse, let injected content run as script. Encoding those characters to & and < keeps the text rendering as text.
The encode all non-ASCII option goes further and converts every character above the ASCII range (accented letters, symbols, emoji) into a numeric entity. That is useful when a document, email template, or legacy system is not reliably UTF-8 and you want the bytes to survive intact. For a normal UTF-8 page you only need the five structural characters, which is the default.
Decoding is the inverse: paste escaped markup you are debugging (from a log line, a JSON string, or a database field) and read it back the way a browser would render it. Because the decoder resolves references without touching the DOM, it is safe to run against text you do not trust.
Frequently asked questions
- Which characters have to be encoded as HTML entities?
- Inside HTML markup the essential ones are the ampersand (&), less-than (<), and greater-than (>). They start references and tags, so leaving them literal can break the page or open an XSS hole. Inside a double-quoted attribute you also need to escape the double quote ("), and inside a single-quoted attribute the apostrophe ('). Encoding those five covers the vast majority of real cases; everything else is optional and only needed for legibility or legacy encodings.
- What is the difference between a named and a numeric entity?
- A named entity uses a human-readable label (&, ©, —), while a numeric entity references a Unicode code point directly, in decimal (©) or hexadecimal (©). Both resolve to the same character; ©, ©, and © are all the copyright sign. Numeric references work everywhere because they do not depend on the parser knowing a particular name, which is why the "encode all non-ASCII" option here emits numeric entities.
- Why should apostrophe be encoded as ' instead of '?
- The ' named entity is defined in XML and HTML5 but was not part of HTML 4, so a few older parsers render it literally as the four characters. The numeric reference ' is understood by every parser ever shipped, so this tool emits ' when it escapes an apostrophe to stay maximally compatible. On the decode side it accepts both ' and '.
- Is it safe to decode untrusted HTML entities with this tool?
- Yes. A common shortcut for decoding is to set element.innerHTML and read back the text, but that parses the string as live HTML and can execute injected markup. This tool never does that. It resolves named references from a fixed lookup table and numeric references with String.fromCodePoint, so decoding only ever produces plain text and can never run a script or touch the DOM.
- What happens to a malformed or unknown entity?
- It is left exactly as you typed it. A stray "&" with no matching ";", an unknown name like ¬real;, or an out-of-range numeric reference such as � are all passed through verbatim rather than dropped or guessed at, so decoding never silently loses characters. Valid references around the broken one still decode normally.
- Is my data sent anywhere?
- No. Encoding and decoding both run in your browser with plain JavaScript. There are no network requests, no logging, and no storage. Your text never leaves the tab, so it is safe to paste snippets that contain internal markup, tokens, or user data.