HTML Entity Encoder / Decoder
Convert special characters into HTML entities — and decode entities back into readable text — with named and numeric forms, a live preview of exactly what the browser renders, and a searchable reference of every named entity.
Paste text and the conversion runs live as you type. On the Encode tab you pick the
form — named entities (é, —), named with a numeric
fallback, decimal (©) or hexadecimal (©) — and the
scope (the five characters that must be escaped, every non-alphanumeric character, or literally
everything). Every character is shown in a breakdown table, and the rendered preview shows what the
browser will actually display. The Decode tab reverses it: named, decimal and hex
entities, decoded exactly the way a browser decodes them (all 2,125 HTML5 names, including the 106
legacy forms that work without a trailing semicolon), with unknown references flagged by position and
invalid code points replaced with U+FFFD — just like a browser. The Entity Reference tab is a searchable table of all 1,446 named entities
— click any row to copy it.
Text → HTML entities
Rendered preview
What a browser displays when it parses your encoded output — this is the point of encoding: the entities below turn back into the characters on the left.
What got encoded?
Every character in your input and what it became. Blue rows changed; grey rows were outside the selected scope and passed through untouched.
HTML entities → Text
&, <, ©) also decode without the trailing ; in every browser. Turn this off for strict semicolon-required behaviour (as in XML).
Decoded preview
The result as plain text — what you would read if the entities were written out.
Entity breakdown
Every entity reference found in your input. Blue rows decoded; orange rows are unknown or invalid and were left exactly as written.
Entity Reference
All 1,446 characters that have a named entity in HTML5, with their canonical name, decimal and
hexadecimal code points. Search by name, character or code point — click any row to copy the
named entity. (HTML5 recognises 2,125 names in total once aliases like & are
included; the canonical name is shown here.)
What are HTML entities?
HTML uses < to start tags and & to start character references, so
neither of those characters can appear in your text as themselves — the browser would read
them as markup. An entity (formally, a character reference) is the escape form:
< displays as <, & displays as
&. There are three forms, all shown below rendering the same character:
| Form | Example | Displays as | Notes |
|---|---|---|---|
| Named | © | © | Readable and greppable, but only 1,446 characters have names — no named entity exists for emoji, CJK or most symbols |
| Decimal numeric | © | © | Works for any character: &# + the code point + ; |
| Hex numeric | © | © | Same, in hexadecimal — more compact for high code points (€ is € but €) |
The five characters you must always escape
| Character | Entity | Why it bites |
|---|---|---|
& | & | Always. It starts a character reference — an unescaped & in “Tom & Jerry” can swallow nearby text into a bogus entity or break the page |
< | < | Always. It starts a tag — unescaped <script> in a paragraph becomes live, executable code |
> | > | Almost always. A stray > rarely breaks HTML parsing, but it is required for correctness (and mandatory in XML, including inside <![CDATA[…]]> handling) |
" | " | Inside double-quoted attributes — an unescaped quote ends the attribute early and the rest of the value becomes new attributes |
’ | ' (or ') | Inside single-quoted attributes — same problem as above. ' is an HTML5 (and XML) entity; HTML4 writers used ' |
The order of escaping matters if you roll your own: replace & first, or
the ampersands you just introduced get escaped a second time.
Named vs numeric: which should I use?
Named entities are self-documenting (— tells you what it is without a hex
calculator), but the named set is small: 1,446 characters. Everything else — emoji,
accented letters beyond Latin, CJK, mathematical alphanumerics — only has numeric forms.
If your content is plain English prose, named is pleasant. If it is arbitrary user text, a log
line or a JSON payload, numeric (or named-with-numeric-fallback, this tool’s second mode)
is the safe choice because it can represent every character in the input.
Browsers decode all 2,125 recognised names — the canonical ones plus legacy aliases such as
& and ©. This tool’s decoder implements the full
HTML5 table, so what you see here is what a browser will render.
The semicolon gotcha
In HTML5 a named reference is only recognised if it ends with ; — with one
legacy exception. 106 names (the old HTML 2/3 set: &, <,
©,  , …) also decode without the
semicolon, for compatibility with ancient pages. So © displays © in a
browser, but &er; displays literally as &er; — the
browser never trims a name to find a shorter match inside it. XML and SGML have no such
exception: the semicolon is always mandatory there. The Decode tab has a switch for both
behaviours.
Common pitfalls
- Double encoding. If your output contains
&lt;(which displays as the text<), something escaped an already-escaped string. Decode once, not twice — the same bug as%2520in URL encoding. - Escaping twice in application code. A template engine that auto-escapes plus a manual
escape()call produces the same&symptom. Pick one layer and escape exactly there. &in URLs inside HTML. Inhref="https://x.com/?a=1&b=2"the&separating query parameters must be written&in the markup. Browsers tolerate the bare form; validators (and some XML pipelines) do not. is not a space. It is U+00A0, the non-breaking space. An ordinary space (U+0020) has no named entity — in named mode this tool leaves it alone, and in numeric mode it becomes .- Decoding is not sanitising. Decoding user-supplied entities and inserting the result into a page as HTML re-introduces whatever the entities were hiding (
<script>decodes to a live tag). Decode for display as text; re-encode before inserting into markup. - Entities in attributes. A
&in an attribute value must be&regardless of whether the attribute uses single or double quotes — the quote-style rules above only cover the quote characters themselves.
From the command line
The same two operations exist in every language. Python’s standard library does both:
html.escape(text, quote=True) and html.unescape(text). PowerShell has
[System.Net.WebUtility]::HtmlEncode() / HtmlDecode(). JavaScript has no
built-in — which is why this page exists.
Nothing on this page leaves your browser: there is no server round-trip when you type or paste, no analytics on your inputs, and no storage of any kind.
