HTML entity encoder and decoder

Runs locally

Escape text for HTML, or turn &entities; back into characters.

Escapes & < > " ' — safe in text and quoted attributes.

Text

Encoded

106 characters

Guide

Which characters actually need escaping — and where

In HTML only a handful of characters are dangerous: < and & start markup, and " or ' end an attribute value. Escaping those five is enough to display any text safely inside an element or a quoted attribute, and it is what the Minimal mode does. Everything else, including accented letters and emoji, is valid as-is in a UTF-8 page.

The other two modes exist for other destinations. Named mode writes common symbols as readable names (©, —,  ) for hand-edited templates. All-non-ASCII mode turns every character above U+007F into a numeric reference, for the rare pipeline that is not UTF-8 clean — old email systems, some XML tools, a database column with the wrong charset.

Text to put in a page

<p>Tom & Jerry's "R&D" — €1,200</p>

Minimal and ASCII-only

Minimal:
&lt;p&gt;Tom &amp; Jerry&#39;s &quot;R&amp;D&quot; — €1,200&lt;/p&gt;

All non-ASCII:
&lt;p&gt;Tom &amp; Jerry&#39;s &quot;R&amp;D&quot; &#x2014; &#x20AC;1,200&lt;/p&gt;

The dash and the euro sign are left alone by Minimal because a UTF-8 page displays them correctly. Only the five markup characters change.

Where people get caught

Escaping HTML is not escaping JavaScript or URLs

Entities protect text inside HTML. Inside a <script> block, an onclick handler or an href, different rules apply: use JSON encoding for script, and URL encoding (then HTML escaping) for links.

Encode once, at output

Escaping on input and again on output gives &amp; on screen. Store the raw text and escape it once, when it is written into the page.

A missing semicolon still decodes — sometimes

  is not a space

It decodes to U+00A0, which looks like a space but does not match " " in code, breaks string comparisons and survives trim(). The breakdown shows it as [nbsp] so it cannot hide.

About HTML entity encoding

How it works in 5 steps · 4 common use cases · 3 questions answered

How it works

1.Choose Encode or Decode.
2.For encoding, pick Minimal, Named or All non-ASCII.
3.Paste text, or upload an .html or .txt file.
4.In Decode mode, every entity reference is listed with the character it becomes.
5.Copy the result or download it as a file.

Common use cases

•Showing a code sample or user-supplied text inside an HTML page
•Reading an HTML-escaped string copied out of a template or API response
•Making a snippet safe for an ASCII-only email or legacy system
•Finding a stray   that breaks a string comparison

FAQ

Is this enough to prevent XSS?

Minimal encoding makes text safe inside element content and quoted attribute values. It does not make text safe inside script, style, unquoted attributes or URLs; those need their own encoding.

How many named entities does the decoder know?

In the browser it uses the browser’s own HTML parser, which knows all 2,231 named references in the HTML standard. It builds an inert document, so nothing in the text runs or loads.

Why is ' used for the apostrophe instead of '?

' is not defined in HTML 4 and some older parsers ignore it. ' works everywhere.