How to use the html entity encoder / decoder
- Choose Encode to turn text or HTML source into entities, or Decode to turn entities back into characters. Pasting text with entities switches to Decode automatically.
- For encoding, decide whether to escape only & < > " ' (ideal for templating) or every non-ASCII character too, and whether numeric references should be decimal or hexadecimal.
- Copy or download the result, or press Swap to convert it back the other way.
Features
- Named entities from the full HTML 4 set (Latin-1, Greek, arrows, maths, punctuation) with numeric fallback
- Minimal mode that escapes only the characters that can break HTML or enable XSS
- Decodes named, decimal and hexadecimal references, including emoji and legacy references without semicolons
- Browser-accurate handling of edge cases such as – and invalid code points
- Auto-detects whether pasted text should be encoded or decoded
When to escape and what to escape
In HTML, & starts an entity and < starts a tag, so user-provided text placed into a page must have those characters escaped, plus " and ' when the text goes inside an attribute value. Escaping only those five characters is enough for security and keeps the source readable, which is why templating engines do exactly that. Encoding every accented or non-Latin character is only needed for documents that are not served as UTF-8, which is rare today.
Named versus numeric references
© and © and © all produce ©. Named references are readable but only about 250 of them exist in HTML 4 (HTML5 defines more than 2,000, but browsers are the only place all of them are recognised). Numeric references work for every Unicode character, including emoji, and are the safe choice in XML, SVG and email templates where named entities beyond the basic five may not be defined.
Decoding quirks browsers apply
Browsers accept a few legacy names without a trailing semicolon (&, <, ©) and this decoder does too. Numeric references € to Ÿ are remapped to Windows-1252 characters, so – becomes an en dash rather than a control character. References to 0, surrogates or values above U+10FFFF become the replacement character.