# HTML entity encoder and decoder

> Escape text for HTML (angle brackets, ampersands and quotes) or decode named and numeric entities back to text. Free, no sign-up, runs in your browser.

Canonical: https://toolspace.tech/html-entity-encoder/
Last updated: 2026-10-25

Escape text so it shows as text in HTML, or turn entities like & and é back into characters. Decoding runs as plain text processing, never as HTML.

This is an interactive tool that runs in the browser: [open the HTML entity encoder](https://toolspace.tech/html-entity-encoder/) to use it. Nothing typed into it is uploaded.

## Worked example

A snippet of HTML escaped with named entities, so it can be shown as code on a web page.

**text**

```
<a href="/?q=fish&chips">Fish & chips</a>
```

**escaped**

```
&lt;a href=&quot;/?q=fish&amp;chips&quot;&gt;Fish &amp; chips&lt;/a&gt;
```

## Common mistakes

### Escaping twice

Encoding already-escaped text turns &amp; into &amp;amp;, which shows up on the page as “&amp;”. Decode first if you aren’t sure.

### Forgetting the semicolon

&copy without the semicolon only works by accident for a few old names. Always write &copy;.

### Escaping only < and >

An unescaped & or quote can still break an attribute value or start an entity. Escape all five special characters.

### Using entities to stop script injection in JavaScript or URLs

HTML escaping protects HTML text and attributes. Inside a `<script>` block, a URL or CSS, each context needs its own escaping.

## How it works

1. **Choose Encode or Decode:** Encode escapes & < > " and ' so a browser shows them instead of treating them as markup. Decode reverses it.
2. **Pick a style:** Named entities (&lt;), decimal (&#60;) or hex (&#x3C;). Turn on Encode non-ASCII to also escape accented letters, symbols and emoji.
3. **Copy the result:** Switching direction moves the output into the input, so you can check a round trip in one click.

## Questions

### Which characters must be escaped in HTML?

In text, & and < always; > for safety. Inside attribute values, also the quote you used around the value. This tool escapes all five (& < > " ') so the result is safe in both places.

### Why is the apostrophe written as &#39; and not &apos;?

&apos; came with XHTML and HTML5 and isn’t in HTML 4, so some older software doesn’t know it. &#39; works everywhere. The decoder understands both.

### Which named entities does the decoder know?

The full HTML 4 set of 252 names, from &nbsp; and &copy; to Greek letters, arrows and math symbols, plus &apos;. Any numeric entity works. Unknown names are left as written and listed above the output.

### Do I need entities for accents and emoji?

Not if the page is served as UTF-8, which almost every page is. Escape them only when the text has to pass through a system that mangles non-ASCII characters.

### Is it safe to decode untrusted text here?

Yes. Decoding is a lookup in a table; the text is never put into the page as HTML, so a decoded `<script>` tag is only text.

## Related

- [URL encoder](https://toolspace.tech/url-encoder-decoder/)
- [Base64 encoder](https://toolspace.tech/base64-encode-decode/)
- [HTML beautifier](https://toolspace.tech/html-beautifier/)
- [Markdown preview](https://toolspace.tech/markdown-preview/)