HTML Entity Encoder / Decoder

Paste HTML or text and it is escaped or unescaped as you type.

Your text and files never leave your browser — nothing is sent to a server.

How to use

  1. Paste your text and choose Encode or Decode.
  2. Keep “Only & < > " '” to make text safe to drop into an HTML page or attribute without breaking the markup.
  3. Choose “all non-ASCII characters” if the page or email might not be served as UTF-8 — accents, symbols and emoji become plain ASCII entities.
  4. Pick named entities (&eacute;) for readability, or decimal / hex numeric references for maximum compatibility.
  5. Decoding understands numeric references and the full HTML 4 named set (about 250 names, plus &apos;).

FAQ

Which characters must be escaped in HTML?

In text, & and < must always be escaped. Inside attribute values, also escape the quote character that wraps the value. Escaping > as well is a common, harmless habit.

Named or numeric entities — which should I use?

Named entities such as &copy; are easier to read, but only a fixed list exists. Numeric references like &#169; or &#xA9; work for every Unicode character.

Does escaping protect against XSS?

Escaping user text before inserting it into HTML is an important part of preventing cross-site scripting, but JavaScript, URLs and CSS contexts need their own escaping rules.

Related tools

All tools