HTML Entity Encoder & Decoder
Escape text as named, decimal or hex HTML entities, or decode entities back to text.
How to use the HTML Entity Encoder & Decoder
- 1Paste text or HTML and choose Escape or Unescape.
- 2Pick named, decimal or hex entities and how much to escape: just & < >, attribute-safe, or every non-ASCII character.
- 3Copy the result, or click an entry in the table of common entities to copy it.
About HTML Entity Encoder & Decoder
The HTML Entity Encoder & Decoder escapes text so it can be placed safely in HTML or XML, and turns entities back into readable characters. When escaping you choose the entity style, named like é, decimal like é or hex like é, and the scope: only & < >, attribute-safe including quotes, or every non-ASCII character. Characters without a named entity, such as emoji, fall back to a numeric reference of your choice.
A target switch limits output to the five entities XML and SVG understand. When unescaping, the tool can parse text the way a browser does, strictly with required semicolons, or as XML, and decode repeatedly to undo double escaping such as &amp;lt;. A table of common entities lets you copy symbols like the non-breaking space, copyright sign or arrows with a click.
The HTML escape tool is useful for showing code samples on a web page, preparing text for templates, RSS feeds and XML files, cleaning up content copied from a CMS, and checking how user input should be encoded to prevent broken markup.
Frequently asked questions
Which characters must be escaped in HTML?
In text, & and < must be escaped (> is escaped by convention). Inside attribute values, also escape the quote character that surrounds the value. Everything else can be written as is in a UTF-8 page.
Named, decimal or hex entities: which should I use?
They are equivalent in HTML5. Named entities such as é are easier to read, but only about 1,500 characters have one, so emoji and most scripts need numeric references like 😀. XML only knows five names (& < > " '), so choose the XML target there.
Why do I see &amp; in my page?
The text was escaped twice. Turn on "Decode repeatedly" to undo every layer, then fix the code that escapes it a second time.
Does escaping protect against XSS?
Escaping & < > " and ' is the core defense for text and quoted attributes. It does not make untrusted text safe inside <script>, style attributes or URLs such as href="javascript:..."; those need their own encoding or validation.
More in Encode & Format
Encode text and files to Base64 or decode Base64 back, with URL-safe and data URI options.
Percent-encode or decode URLs and query strings, and edit every URL part in a table.
Format, minify and validate JSON with exact error positions, sorted keys and string escaping.