HTML Entity Encoder & Decoder
Escape text for HTML so <, > and & show as characters instead of breaking the page, or turn entities like &, é and ’ back into plain text.
Decodes all named entities of the HTML standard, exactly as browsers do. Runs in your browser.
Related Developer Tools
Use the encoder when you want to show code or user-written text on a web page without the browser treating it as HTML, for example a code snippet in a blog post or a product name containing < or &. Use the decoder to read text copied from page source, an RSS feed or an API that returns entities such as " or ’. Decoding follows the HTML standard's rules, so the result matches what a browser displays.
Common HTML Entities
| Character | Named | Number | Use |
|---|---|---|---|
| < | < | < | Less than; starts a tag |
| > | > | > | Greater than |
| & | & | & | Ampersand; starts an entity |
| " | " | " | Double quote in attributes |
| ' | ' | ' | Apostrophe in attributes |
| (space) | |   | Non-breaking space |
| © | © | © | Copyright |
| ® | ® | ® | Registered trademark |
| ™ | ™ | ™ | Trademark |
| € | € | € | Euro |
| £ | £ | £ | Pound |
| — | — | — | Em dash |
| – | – | – | En dash |
| ’ | ’ | ’ | Right single quote, apostrophe |
| “ ” | “ ” | “ ” | Curly double quotes |
| … | … | … | Ellipsis |
| × | × | × | Multiplication sign |
| → | → | → | Right arrow |
Related Tools
Encode text for a link with the URL encoder, format a whole page with the HTML formatter, or convert Markdown to safe HTML with the Markdown to HTML converter.
Frequently Asked Questions
What are HTML entities?
Codes that stand for a character in HTML. They start with & and end with ;. A few characters have a special meaning in HTML, so to show them as text you write them as entities: < for <, > for >, & for & and " for a double quote. Any character can also be written by number, such as é or é for é.
Which characters must be escaped in HTML?
In text: < and &. Inside an attribute value: & and the quote character around the value (" or '). Escaping all five of & < > " ' everywhere is the simple safe rule, and it is what Encode does by default. Other characters, including accented letters and emoji, can be written directly when the page is saved as UTF-8, which almost every page is.
When should I encode non-ASCII characters as entities?
Rarely. It helps when text must pass through a system that only handles plain ASCII, such as some email templates or old databases, or when you want invisible characters such as a non-breaking space ( ) to be visible in the source. Otherwise keep characters as they are; the file is shorter and easier to read.
Why does it use ' instead of '?
' is defined in HTML5 and XML but was not part of HTML 4, so some older software does not recognise it. ' means the same apostrophe everywhere.
Does escaping HTML protect against XSS?
Escaping user input before inserting it into HTML text or a quoted attribute stops it being read as tags or scripts, which prevents the most common cross-site scripting attacks. It is not enough inside <script> blocks, event handler attributes, style values or URLs (a javascript: link survives HTML escaping), which need their own encoding or validation. Templating libraries such as React escape text for you.
Why does decoding leave some entities unchanged?
They are not entities in HTML, usually because of a typo or wrong capital letters: names are case-sensitive, so É is É and é is é, while &EACUTE; means nothing. The decoder lists such names under the result. Numeric references always decode; invalid numbers become the replacement character �.