HTML Entity Encoder / Decoder
Escape text for safe use in HTML or turn entities like é and 😀 back into characters. Choose which characters to encode and whether to use named, decimal or hex entities.
HTML entity reference
| Char | Named | Decimal | Hex | Description |
|---|
Click a row to copy its named entity. Everything runs in your browser.
How to use the HTML Entity Encoder / Decoder
- Choose Encode or Decode with the tabs at the top.
- Paste your text into the input box. The result appears instantly on the right.
- When encoding, pick what to encode: only the reserved HTML characters, all non-ASCII characters, or everything, and choose named, decimal or hex entities.
- Press Swap to send the output back to the input and switch direction, for example to check a round trip.
- Copy the result, or search the entity reference table below and click a row to copy an entity.
The five characters you should always escape
| Character | Entity | Numeric | Why |
|---|---|---|---|
| & | & | & | Starts every entity, so a bare & can be misread |
| < | < | < | Starts a tag |
| > | > | > | Ends a tag; escaping it keeps output unambiguous |
| " | " | " | Ends a double-quoted attribute value |
| ' | ' (or ') | ' | Ends a single-quoted attribute value |
Example: the text Tom & Jerry <3 placed in a page must be written as Tom & Jerry <3. Otherwise the browser sees the start of a tag and the rest of the line may disappear.
Encode modes explained
- Reserved only is what you need for UTF-8 web pages and templates: it makes text safe to place inside HTML while keeping é, € and emoji readable.
- Reserved + all non-ASCII turns every character above code point 127 into an entity. Use it for systems that only accept plain ASCII, such as some email templates, legacy databases or source files with an unknown encoding.
- Everything encodes every character, letters included. It makes text unreadable in the source, which is occasionally used to obscure email addresses from simple scrapers.
How numeric references work
A numeric character reference is the Unicode code point of the character. The euro sign is U+20AC, which is 8364 in decimal, so it can be written as €, € or by name as €. Emoji have code points above 65,535: 😀 is U+1F600, written 😀 or 😀.
For historical reasons browsers treat references from 128 to 159 as Windows-1252 characters, so – shows an en dash (–) and € a euro sign. The decoder follows the same rule, and invalid references such as � or lone surrogates become the replacement character �.
Frequently asked questions
What are HTML entities?
HTML entities are codes that stand for characters. They start with an ampersand and end with a semicolon, such as < for <, © for © or é for é. They let you show characters that have a special meaning in HTML, or that are hard to type.
Which characters must be escaped in HTML?
Always escape & as & and < as <. Escape > as > too for safety. Inside attribute values also escape the quote character you use: " as " and ' as '. With UTF-8 pages, other characters such as é or € can be written directly.
What is the difference between named, decimal and hex entities?
They produce the same character. A named entity uses a memorable name (é), a decimal reference uses the Unicode code point in base 10 (é) and a hex reference uses it in base 16 (é). Numeric references work for every character, while names exist only for some.
Is HTML escaping enough to prevent XSS?
Escaping &, <, >, " and ' is the right defence for text placed between tags and inside quoted attributes. It is not enough for other contexts such as JavaScript code, CSS, or URLs in href attributes, which need their own encoding and validation.
Why does ' not work everywhere?
' was defined in XML and XHTML but not in HTML 4, so very old browsers and some email clients do not recognise it. ' works everywhere, which is why this encoder uses it by default.
How do I decode text that was encoded twice?
Double-encoded text looks like &lt;p&gt;. Tick Decode repeatedly and the decoder keeps decoding until no entities are left, so you get <p> back.
How are emoji encoded?
Emoji and other characters outside the Basic Multilingual Plane are encoded as one numeric reference using their full code point, for example 😀 becomes 😀 or 😀, not two surrogate halves.