HTML Entity Encoder / Decoder
An HTML entity encoder and decoder in one box: escape & < > " and ', or fold entities back into plain characters.
Encoded
The encoded text appears here.
Every entity it makes is marked.
Encoded
Not text
Direction
Above ASCII
Already escaped
What changed
How to use
- Choose the Direction: Encode to escape text going into a page, Decode to read text full of é codes and é names.
- Type or paste into the first well. The second well follows as you type, every entity or decoded character marked, and the report under the wells counts them.
- Tick Non-ASCII to numeric entities first when the destination is ASCII-only, or Leave existing entities alone when the text is already partly escaped, then press Copy output. The swap between the wells sends the result back as the input with the direction turned round.
About this tool
An HTML entity encoder exists because five characters cannot be typed straight into a page. Ampersand, less-than, greater-than and the two quote marks all mean something to the parser, so a product name like Tom & Jerry's or a snippet containing <div> either renders wrong or, when the text came from a stranger, hands them a script tag. With Encode chosen, type or paste the raw text and those five come back as & < > " and ' in the second well, each one marked.
Decode runs the other way, and it reads references the way a browser does: the whole HTML table of 2,231 names, decimal and hex numbers, and the legacy names a browser still accepts without a semicolon, so café and Tom & Jerry both come back as plain text. A number that can never be text, such as � or a lone surrogate, becomes the replacement character U+FFFD, and a name HTML does not define stays exactly as typed and is counted.
Non-ASCII to numeric entities widens the net to every character above code point 127. Accented letters, currency symbols, box-drawing characters, emoji. The walk reads whole code points, so a grinning face comes out as the single entity 😀 instead of a broken surrogate pair, and the report names each character beside the entity it became.
I reach for the decode side far more often than the encode side. Something arrives out of a CMS export or a log line with ’ scattered through the sentences, and I just want to read it. When the text arrives half-escaped instead, Leave existing entities alone keeps the & and < that are already there and escapes only the bare characters around them.
Before you rely on it
- Escaping these five characters covers text going into element content. A value dropped into an attribute, a URL behind href, and anything interpolated into script or CSS each need their own rules on top, so treat this as one layer of an XSS defence.
- Numeric output is decimal. Both decimal and hex decode everywhere, so é serves where a style guide asks for é, but the page will not write the hex form for you.
- Named output covers the five reserved characters only. é goes out as é rather than é, because a number needs no table on the reading side.
Frequently asked questions
What exactly gets escaped when I encode?
Five characters, always the same five: & becomes &, < becomes <, > becomes >, " becomes ", and ' becomes '. The apostrophe comes out numeric rather than as ' on purpose, since ' was never part of HTML 4 and old parsers can trip on it.
Why did my & turn into &amp;?
The text you pasted was already escaped, and by default every ampersand is escaped, including the ones that open an existing entity. Tick Leave existing entities alone and a well-formed reference that ends in a semicolon and names a real character is passed through untouched, while a made-up one like &bogus; is still escaped.
Does escaping HTML stop XSS on its own?
It stops the common case, which is untrusted text landing in the body of a page. It does not cover a value dropped into an unquoted attribute, or anything interpolated into a script block where the parsing rules are different. Those spots have their own escaping requirements.
Why does &Amp; stay as it is when & decodes?
Named references are case-sensitive, and the HTML table lists & and & but not &Amp;. A browser shows &Amp; as those five characters, so the decoder leaves it standing and counts it. Numeric references are the exception: A and A are the same letter A.
Should I write é or é in my HTML?
Write é. Any page served as UTF-8 handles it fine, and the entity form only makes the source harder to read. Numeric entities earn their keep when something in the pipeline is ASCII-only, like an old email template or a config format pinned to a fixed charset. That is what the non-ASCII switch is for.
Can I paste a whole HTML file in here?
The well will hold as much text as you throw at it, but there is no file picker, and running a full document through Encode would escape the tags you meant to keep. For a whole file, find-and-replace in your editor or a step in your build is the better move.
Missing something in HTML Entity Encoder / Decoder? Suggest a feature →
Tell someone who needs this.