HTML entities encoder & decoder
Convert special characters to HTML entities and back, all client-side. Three encoding modes — special only, all non-ASCII, or numeric only — with idempotent encoding and robust mixed-input decoding.
What are HTML entities?
HTML entities are escape sequences that represent reserved or non-ASCII characters in HTML source. The five most common — & < > " ' — must be entitised to prevent the browser from interpreting them as HTML markup. Entities also let you embed any Unicode code point regardless of the file encoding.
Named vs numeric entities
Named entities like & or © are easier to read but limited to ~250 predefined characters. Numeric entities like & (decimal) or & (hex) work for any Unicode code point and are universally supported. When in doubt — and especially in XML — use numeric.
When should you escape HTML?
Always escape any user-supplied text before injecting it into HTML — comments, search queries, profile fields, error messages. Skipping this step is the most common XSS bug. Server-side templating engines and modern frameworks usually do this automatically; raw string concatenation does not.
Need URL encoding instead? Try our URL encoder / decoder.
Common Uses
- Preventing XSS: Escape user-submitted comments, profile fields, and search queries before rendering them in HTML to block script injection.
- Email template safety: Encode dynamic name and message fields in transactional emails so HTML-aware clients render content as text, not markup.
- Static site builders: Pre-encode markdown-derived content during build so the resulting HTML is XSS-clean even with mixed-source authoring.
- JSON-to-HTML migration: Convert API string fields containing HTML metacharacters into safe entity form before pasting into a server-rendered template.
- Logging & debugging: Encode raw payloads before writing to HTML log viewers so curly-brace and angle-bracket characters don't break the layout.
- Documentation snippets: Show literal HTML markup inside <code> or <pre> blocks by entitising the angle brackets so they render as text.
- Legacy CMS migration: Decode HTML-entitised content exported from older CMS systems back to plain text for re-importing into a modern editor.
FAQ
What are HTML entities and why do I need them?
They're escape sequences that represent reserved characters (& < > " ') and any non-ASCII character without breaking HTML parsing. You need them whenever raw text could be interpreted as markup or whenever the file encoding might not handle the character.
Named vs numeric entities — which should I use?
Use numeric entities (&, &) when targeting any context that might not be HTML — XML feeds, RSS, generic SGML. Use named entities (&, ©) for hand-authored HTML where readability matters and you're sure the parser supports them.
When do I need to escape HTML in user-generated content?
Always — except when you're explicitly using a sanitizer that allows a known-safe subset of HTML (e.g. DOMPurify with a whitelist). Direct concatenation of user text into an HTML response without escaping is the textbook XSS vulnerability.
How do I decode ' and '?
Both decode to the apostrophe character ('). The decoder here accepts named entities like ', decimal ', and hex ' — they all produce the same output. Note that ' is technically only standardised in XHTML and HTML5; very old HTML 4 contexts may not recognise it.
Does this tool send my data anywhere?
No. All encoding and decoding runs entirely in your browser. Your text never leaves your device.
By the Numbers
- The HTML Living Standard defines ~250 named character references — most browsers also accept the older HTML 4.01 set
- OWASP recommends escaping five characters (
&,<,>,",') when inserting untrusted text into HTML body context - Numeric character references (e.g.
&) work for any Unicode code point — useful when a named entity isn't available or supported - XML supports only five named entities (
amp lt gt quot apos) — strict XML parsers reject HTML named entities like©