HTML Entity Encoder & Decoder

How to use it

Choose Encode or Decode, then type or paste into Text to encode or Text to decode. The result updates as you type, in your browser.

1. Encode always turns &, <, >, " and ' into &, <, >, " and '. Escape every character outside ASCII too starts ticked: it also replaces each character above U+007F with a named entity such as é, or a hex reference such as 🦆 where no name exists. Untick it to keep accents, symbols and emoji as they are.
2. Decode reads named (&), decimal (') and hex (') references back into characters and copies everything else through.

The result appears under Encoded or Decoded with a copy button, and the line below it counts what changed.

Examples

An HTML snippet to show as code on a page, with Encode and the non-ASCII box unticked:

<b title="Tom's">Fish & chips</b>

<b title="Tom's">Fish & chips</b>

The line reads 8 characters become a reference. On a page, this shows the tag instead of bold text.

Mixed text, with Escape every character outside ASCII too ticked:

Café — 10 € © ½ ✓ 🦆

Café — 10 € © ½ ✓ 🦆

The duck has no name, so it becomes one hex reference for its code point, U+1F986, not two for its UTF-16 surrogate halves.

Text that was escaped twice, with Decode:

<b>

<b>

The line reads 2 references read. Each pass removes one layer, so decoding again gives <b>. Double escaping usually means a template escaped an already escaped value.

Text with mistakes in it, with Decode:

&copy 2026 Caf&eacut; – �

&copy 2026 Caf&eacut; – �

The line reads 2 references read. 1 named no character and became U+FFFD. 1 looked like a reference but isn’t one, and stayed as text. &copy lacks its semicolon and &eacut; is a typo. – is an en dash, as in browsers, and U+110000 is one past the last code point, U+10FFFF.

Good to know

• Five characters carry meaning in HTML. < opens a tag, & starts a reference, and " or ' ends a quoted attribute value. > is escaped by convention.
• ' becomes ', not '. HTML 4 never defined ', which came from XML; the numeric form works in every HTML and XML parser.
• HTML escaping protects HTML text and quoted attributes only. Inside <script>, CSS or a URL, other rules apply: a javascript: URL in href passes through escaping unchanged and still runs. The OWASP Cross Site Scripting Prevention Cheat Sheet gives the right encoding for each context.
• Names are case-sensitive. É is É and é is é. The aliases &, <, >, ", ©, ® and ™ decode too. When a character has several names, encoding writes the shortest, lower-case one, so ★ becomes ★.
• A reference needs its semicolon here. Browsers still read about a hundred legacy names without one, such as &amp and &copy, but the HTML standard calls that a parse error.
• Numeric references are read as browsers read them, by WHATWG HTML’s rules. �, anything past U+10FFFF and the surrogates U+D800 to U+DFFF become U+FFFD. Most of € to Ÿ are read as Windows-1252, so – is – and € is €. Encoding leaves those control characters as they are, since no reference reads back as them.
•   isn’t a space. It decodes to U+00A0, which doesn’t equal " " in a string comparison. With the non-ASCII box ticked, it comes out as  .
• XML predefines only five names: &, <, >, " and '. é breaks an XML file or RSS feed, so untick the non-ASCII box for XML.
• Decoding knows all 2,125 names in the HTML standard, such as … and ​. Encoding writes only HTML 4.01’s 252 names and a few HTML5 ones like ✓, so … becomes …. Input is limited to 100,000 characters.

Questions

How do I escape HTML special characters?

Replace &, <, >, " and ' with &, <, >, " and ', as Encode does. In code, replace & first or you’ll re-escape your own references. Python’s html.escape(text) handles all five. In the browser, setting element.textContent rather than innerHTML needs no escaping.

How do I decode HTML entities in JavaScript or Python?

In Python, use html.unescape(text), which follows the HTML5 list and rules. In a browser, new DOMParser().parseFromString(text, 'text/html').documentElement.textContent returns the text as the browser reads it, without running scripts. Node has no built-in; the he and entities packages are the usual choice.

Which characters have to be escaped in HTML?

In text, < and &; in a quoted attribute value, & and the quote around the value. Escaping all five everywhere is simpler and always safe.

Where is the full list of HTML entities?

It’s the “Named character references” table in the WHATWG HTML Living Standard, also published as entities.json. To find a character’s name, paste it with Escape every character outside ASCII too ticked.