HTML Entity Encoder
Encode and decode HTML entities so markup displays as literal text.
Encode and Decode HTML Entities
A browser cannot tell the difference between a less-than sign you want displayed and one that opens a tag. HTML entities resolve the ambiguity: writing < produces a literal < that will never be parsed as markup. The same mechanism handles symbols that are awkward to type and characters that older encodings could not represent.
Escaping the five special characters is also the foundation of preventing cross-site scripting. Any user-supplied text placed into a page must be escaped, because an unescaped <script> from a comment field is the single most common web vulnerability there is.
Key features
- Both directions — encode text to entities, or decode entities back to text.
- Named or numeric — prefer readable names like
©or force numeric references everywhere. - Optional full escaping — encode every non-ASCII character for maximum compatibility with legacy systems.
- Safe decoding — decoding uses a textarea, whose content can never execute, so pasting hostile markup is inert.
- Reference table — the thirty entities people actually look up, with named and numeric forms.
This tool runs entirely inside your browser using native Web APIs. Your files and text are never uploaded to a server, never logged and never shared with third parties.
How to use: HTML Entity Encoder
- Choose encode or decode
Encoding turns characters into entities; decoding turns entities back into characters. - Paste your text
The result appears immediately in the panel opposite. - Choose named or numeric
Named entities are far more readable; numeric references work everywhere, including contexts where the name might not be defined. - Enable full escaping if needed
Encoding every non-ASCII character guarantees your text survives systems with an unreliable charset declaration.
Technical specifications
| Processing location | Entirely in your browser — no server round trip |
|---|---|
| Data uploaded | None. Files and text never leave your device |
| Price | Free — no account, no trial, no usage cap |
| Category | Developer |
| Works offline | Yes, once the page has loaded |
| Browser support | Chrome 90+, Edge 90+, Firefox 90+, Safari 15+ |
| Interface languages | English, 中文, हिन्दी, Español, العربية |
Frequently asked questions
Which characters must always be escaped in HTML?
Five: <code>&</code> <code><</code> <code>></code> <code>"</code> and <code>'</code>. The ampersand must be escaped first, otherwise you would double-encode every other entity you produce.
What is &nbsp; and when should I use it?
A non-breaking space — a space that prevents a line break at that point. Use it between a number and its unit, or in a name you do not want split across lines. Do not use it for indentation or layout spacing; that is what CSS is for.
Does escaping prevent XSS?
Context-appropriate escaping is the core defence, but the correct escaping differs by context. HTML-escaping is right for text between tags, but attribute values, URLs, JavaScript strings and CSS each need their own treatment. Use your framework’s auto-escaping rather than hand-rolling it.
Do I still need entities with UTF-8?
For the five reserved characters, always. For accented letters, emoji and other symbols, UTF-8 handles them directly and entities are optional — they are mainly useful when you cannot guarantee the charset is declared correctly.