About the HTML Entity Encoder
HTML entities let you write characters that would otherwise be read as markup, or that are hard to type. This tool escapes text for safe use in HTML and turns entity-encoded text back into plain characters.
Encoding always escapes the five characters that matter in markup: &, <, >, " and ' (as '). Two options control the rest. Prefer named entities uses readable names for about 50 common characters, such as ©, €, — and é. Encode non-ASCII as numeric writes every other non-ASCII character as a numeric reference, in decimal (é) or, with Hex numeric, hexadecimal (é). Decoding uses the browser's HTML parser, so it understands every named entity in the HTML standard as well as numeric references. Everything runs locally.
How to use it
- Choose Encode or Decode. Prefilled input that contains entities opens in Decode.
- Paste your text; the output updates as you type.
- Adjust the encoding options if needed.
- Copy the output, or click Swap to reverse it.
Examples
- Escape a snippet of markup: the tags and
&become<,>,"and&. - Decode escaped HTML: gives back
<p>Café © 2026</p>.
Common questions
Which characters must be escaped in HTML?
In text content, & and < are the ones that break parsing. Inside attribute values, also escape the quote character that delimits the value. Escaping all five is the safe default.
Is entity encoding enough to prevent XSS?
It protects text placed in HTML body content and quoted attributes. It doesn't make data safe inside <script> blocks, style attributes or javascript: URLs, which need context-specific handling.
Do I need entities for accented characters?
Not if the page is served as UTF-8, which is standard. Entities are useful when the file encoding is uncertain or a system only accepts ASCII.
Related tools
- Base64 & URL Encoder / Decoder: percent-encode text for URLs instead.
- Markdown Live Preview: write content and copy the rendered HTML.
- XML Formatter & Validator: check escaped content inside XML documents.