HTML entity encoder and decoder
Type in the Text box to escape it for HTML, or paste HTML with entities into the HTML box to decode it. Both update as you type.
How to encode and decode HTML entities
- Encode: type in the Text box. Minimal escapes only
&<>"and', which is all HTML needs when the page is UTF-8. Named and Numeric also turn accents, symbols and emoji into entities for pure-ASCII output, such as old email templates. - Decode: paste into the HTML box. Every HTML5 named entity (
,→,≱), decimal (é) and hex (é) reference is decoded exactly as a browser would. - Double-encoded? Text like
&lt;was escaped twice. Tick Decode repeatedly to unwrap every layer.
Common HTML entities
| Character | Named | Numeric | Name |
|---|---|---|---|
| & | & | & | Ampersand |
| < | < | < | Less than |
| > | > | > | Greater than |
| " | " | " | Double quote |
| ' | ' | ' | Apostrophe |
| (space) | |   | Non-breaking space |
| © | © | © | Copyright |
| ® | ® | ® | Registered |
| ™ | ™ | ™ | Trademark |
| € | € | € | Euro |
| — | — | — | Em dash |
| … | … | … | Ellipsis |
| → | → | → | Right arrow |
| × | × | × | Multiplication |
Why escape HTML?
Text placed into a page without escaping can break the layout, or let someone inject a script (XSS). Escaping <, >, & and quotes makes the browser show them as characters instead of reading them as markup.
Questions
Which characters must be escaped in HTML?
& and < in text; & and the quote you use in attribute values. Escaping & < > " ' everywhere, as Minimal does, is always safe.
What's the difference between ' and '?
Both are an apostrophe. ' is not defined in HTML 4, so ' is used here because it works everywhere, including old email clients.
Should I encode accents like é as é?
Not on a UTF-8 page: just write é. Named or numeric entities help only when the output must be pure ASCII.
How do I fix & showing on my page?
The text was escaped twice. Paste it into the HTML box with Decode repeatedly ticked, then escape it once.
Does it decode every entity?
Yes. All 2,231 HTML5 names (including legacy ones without a semicolon, like ©) plus every decimal and hex reference, the same way browsers do.
Is this safe to use with untrusted HTML?
Decoding only reads entities; tags in your input are never rendered or run, and nothing is sent anywhere.