HTML Entity Encoder & Decoder
Escape text for HTML with named, decimal or hex entities, or decode any HTML entity back to plain text.
HTML Entity Encoder and Decoder - Escape and Unescape HTML
Paste text and get it escaped for HTML, or paste HTML full of entities and get the plain text back. Encoding can cover just the five characters that break HTML, every non-ASCII character, or everything, written as names, decimal numbers or hex numbers. Decoding understands every named entity in HTML5 as well as numeric ones, because it uses the same parser your browser uses for web pages.
Escaping matters whenever text goes into HTML: a comment shown on a page, a product name in a template, a code sample in a blog post. Unescaped, a stray less-than sign starts a tag and an ampersand starts an entity, and the page shows something other than what was written, or worse, runs something.
How to use it
- Choose Encode or Decode.
- Type or paste the text; the result appears as you type.
- For encoding, pick what to encode and how to Write as: names, decimal or hex.
- Press Copy, or Swap to send the result the other way.
The five characters that matter
| Character | Named | Numeric | Why it needs escaping |
|---|---|---|---|
& | & | & | Starts every entity |
< | < | < | Starts a tag |
> | > | > | Ends a tag; escaped by convention |
" | " | " | Ends a double-quoted attribute value |
' | none in HTML 4 | ' | Ends a single-quoted attribute value |
Encoding only these five, the default here, is what a template engine does when it escapes output: everything else, including accented letters and emoji, can stay as it is in a UTF-8 page.
When to encode more
- Every non-ASCII character: for an email template or a system that is not reliably UTF-8, so é or € survives any encoding mix-up.
- Every character: rarely useful; it makes text unreadable in the source, which is occasionally used to obscure an email address from simple scrapers.
- Non-breaking spaces: tick Also encode non-breaking spaces to make them visible in the source instead of looking like ordinary spaces.
Names or numbers?
To a browser, é, é and é are the same character. Names are easier to read in source code, but only some characters have one; this tool writes names from the HTML 4 set, which every browser and email client understands, and falls back to numbers for the rest, such as emoji. Hex numbers match how Unicode code points are usually written, such as U+00E9.
Decoding safely
Decoding is done by your browser's HTML parser inside a detached text box, where tags are only text. So a pasted <script> or an image with an onerror attribute is shown, never run. That also means the decoder behaves exactly like a real page, including its lenient handling of old entities written without the final semicolon.
Related tools
For text inside a URL rather than HTML, use the URL encoder. For binary data, use the Base64 encoder. The task pages open this tool on one job: escape HTML and decode HTML entities. To write escaped titles and descriptions into meta and Open Graph tags, use the meta tag generator.