HTML Entity Encoder / Decoder
Escape text for HTML, and turn entities back into characters.
Runs in your browser Runs entirely in your browser. Nothing you put in it ever leaves your device.
é, numeric ones such as
— and hexadecimal ones such as
🙂 are all understood. A semicolon is required, so ordinary
text like “AT&T” is left alone rather than mangled.
Converts as you type. Nothing is sent anywhere.
The five characters that can change the meaning of markup —
& < > " ' — are always escaped, whatever the options say.
Ready. Nothing is sent anywhere.
Was this useful?
About this tool
Some characters mean something to an HTML parser rather than being text, so putting them in a page requires writing them as entities. This escapes text for HTML — always the five that matter, and optionally accents, symbols and emoji as well — and decodes in the other direction, turning &eacute; and &#8212; back into é and —.
How to use it
- Choose Encode or Decode.
- Paste your text. The result updates as you type.
- When encoding, turn on the non-ASCII option if the file this is going into has an unreliable character encoding.
- Copy the result, or press Swap to check it round-trips.
Supported input
- Named references (&eacute;, &nbsp;, &copy;)
- Decimal references (&#233;)
- Hexadecimal references (&#x1F642;)
- Any Unicode text, emoji included
Privacy
Runs entirely in your browser. Nothing you put in it ever leaves your device. Everything happens in JavaScript on this page, so the tool keeps working even if you go offline after it has loaded — which is the simplest way to see for yourself that nothing is being sent. Read the full privacy information.
Questions
Which characters have to be escaped?
Five: & < > " and the apostrophe. Those are the ones that can end a tag or an attribute early and so change the meaning of the markup around them. This tool always escapes all five, whatever the other options say.
Does escaping text make my page safe?
It is a necessary part, not the whole of it. Escaping is what stops text being read as markup, but where the text ends up matters too — inside a script block, a style block or a URL attribute, different rules apply. Escape at the point of output, using the tools of whatever is generating the page.
Why does “AT&T” survive decoding unchanged?
Because a semicolon is required. HTML’s own parser accepts a handful of legacy references without one, but applying that rule here would quietly rewrite ordinary prose. A reference with no semicolon is far more likely to be a typo than something intended.
What happens to an entity nothing recognises?
It is left exactly as it was written and the tool tells you which one it was. Nothing is dropped, so you never lose part of your text to a typo.
Why is an apostrophe written as &#39; rather than &apos;?
Because &apos; was not part of HTML 4, so an older parser renders it literally — and the place that bites you is inside a single-quoted attribute, which is exactly where escaping an apostrophe mattered. The numeric form works everywhere.