Developer tool
HTML Entity Encoder and Decoder
Encode text to HTML entities (named, decimal or hex) or decode entities back to characters, with a list of common symbols. Runs in your browser.
Free, no sign-up. Runs in your browser; nothing is uploaded.
Options
Input
Result
Common entities (click to add to the input)
How to use the html entity encoder and decoder
Escape and unescape HTML characters
HTML gives special meaning to a few characters, such as < and &. To show them as text you write entities like < and &. Entities also let you write symbols that are hard to type, from the copyright sign to arrows. This tool converts both ways.
Encode
Paste text and choose how much to encode:
- Only & < > " ' is the minimum for safe display of code or user text.
- Special plus non-ASCII also converts accented letters, currency signs and typographic punctuation, which helps with legacy systems and email.
- Everything but letters and digits converts all punctuation and symbols too.
Then choose the style. Named uses names such as é where they exist and falls back to numbers. Decimal writes é and Hex writes é. All three display the same character.
Decode
Switch to Decode and paste text with entities. Named entities from the common set (all of Latin-1 plus many typographic, arrow, maths and Greek names), and any decimal or hex references, are converted to real characters. Names that are not recognised are left as written so you can spot them.
Common entities
The grid at the bottom lists frequently used ones: © ® ™ € £ … – — and more. Click a symbol to append it to your input.
When to use entities
- Showing code in a page: escape every < and & in the snippet.
- Email templates: some clients mishandle special characters, so numeric entities are safer.
- CMS fields that strip or alter symbols.
- Documentation where you need an exact, visible character.
When not to
For modern UTF-8 pages you can usually type the character itself. Entities are never a substitute for proper output escaping in your application code, which must be applied to all untrusted data.
Frequently asked questions
Which characters must always be escaped?
In text content, & and <. In attribute values, also the quote character that delimits the value. Escaping > and both quotes everywhere is a safe habit.
Named or numeric entities?
Named entities such as © are readable. Numeric ones like © or © work for every character, including ones with no name. Hex and decimal refer to the same Unicode code point.
Do I need to encode non-ASCII characters?
Not if your page is served as UTF-8, which it should be. Encoding them is useful for old systems, emails and editors that mangle special characters.
Does escaping HTML prevent XSS?
Escaping output for the right context is the main defence, but it must be done on the server or by your framework for every untrusted value. This tool is for manual conversions.
What is ?
A non-breaking space, character 160. It looks like a space but keeps words together and is not collapsed. Overusing it for layout is poor practice.
Is my text uploaded?
No. Everything is processed in your browser.