toolspace

HTML entity encoder and decoder

Escape text so it shows as text in HTML, or turn entities like & and é back into characters. Decoding runs as plain text processing, never as HTML.

Loading…

Worked example

A snippet of HTML escaped with named entities, so it can be shown as code on a web page.

text
<a href="/?q=fish&chips">Fish & chips</a>
escaped
&lt;a href=&quot;/?q=fish&amp;chips&quot;&gt;Fish &amp; chips&lt;/a&gt;

Common mistakes

  • Escaping twice

    Encoding already-escaped text turns &amp; into &amp;amp;, which shows up on the page as “&amp;”. Decode first if you aren’t sure.

  • Forgetting the semicolon

    &copy without the semicolon only works by accident for a few old names. Always write &copy;.

  • Escaping only < and >

    An unescaped & or quote can still break an attribute value or start an entity. Escape all five special characters.

  • Using entities to stop script injection in JavaScript or URLs

    HTML escaping protects HTML text and attributes. Inside a <script> block, a URL or CSS, each context needs its own escaping.

How it works

  1. 1

    Choose Encode or Decode

    Encode escapes & < > " and ' so a browser shows them instead of treating them as markup. Decode reverses it.

  2. 2

    Pick a style

    Named entities (&lt;), decimal (&#60;) or hex (&#x3C;). Turn on Encode non-ASCII to also escape accented letters, symbols and emoji.

  3. 3

    Copy the result

    Switching direction moves the output into the input, so you can check a round trip in one click.

Questions

Which characters must be escaped in HTML?
In text, & and < always; > for safety. Inside attribute values, also the quote you used around the value. This tool escapes all five (& < > " ') so the result is safe in both places.
Why is the apostrophe written as &#39; and not &apos;?
&apos; came with XHTML and HTML5 and isn’t in HTML 4, so some older software doesn’t know it. &#39; works everywhere. The decoder understands both.
Which named entities does the decoder know?
The full HTML 4 set of 252 names, from &nbsp; and &copy; to Greek letters, arrows and math symbols, plus &apos;. Any numeric entity works. Unknown names are left as written and listed above the output.
Do I need entities for accents and emoji?
Not if the page is served as UTF-8, which almost every page is. Escape them only when the text has to pass through a system that mangles non-ASCII characters.
Is it safe to decode untrusted text here?
Yes. Decoding is a lookup in a table; the text is never put into the page as HTML, so a decoded <script> tag is only text.