HTML Entities Encode / Decode
Escape text for HTML and turn entities back into text.
About this tool
Escape <, >, &, quotes and optionally every non-ASCII character so text is safe to put into HTML, or decode named and numeric entities like &, é and 🚀 back into plain text.
How to use it
- Choose Encode to escape text for HTML, or Decode to turn entities back into characters.
- Paste your text.
- Optionally encode every non-ASCII character as a numeric entity.
- Copy the result.
Questions
- Which characters must be escaped in HTML?
- & and < always; > for safety; and " or ' inside attribute values. Escaping these five is enough to show user text safely in HTML.
- Does escaping protect against XSS?
- Escaping output for the right context is the core defence for HTML text and attributes. It is not enough inside script tags, event handler attributes or URLs, which need their own encoding.
- Do I need to encode accented letters?
- Not if your page is served as UTF-8, which nearly every modern page is. Encoding all non-ASCII is only useful for systems that can’t handle UTF-8.
- What is the difference between and a normal space?
- is a no-break space, U+00A0. The browser won’t wrap a line at it and won’t collapse several of them into one, unlike normal spaces. Use it to keep values like “10 km” together. For layout and spacing, use CSS instead of chains of .
- Should I use ' or ' for an apostrophe?
- Both work in HTML5 and XML, but ' was not part of HTML 4, so older parsers and some email clients don’t recognise it. ' works everywhere, which is why this encoder uses it. Inside a double-quoted attribute you don’t need to escape the apostrophe at all.
- What is the difference between HTML escaping and URL encoding?
- HTML escaping makes text safe inside HTML; URL encoding makes text safe inside a URL. A link in an href attribute needs both: percent-encode each query value first, then HTML-escape the whole URL, so every & between parameters becomes &. The URL tool handles the percent-encoding step.
What are HTML entities?
An HTML entity is a short piece of text that stands for a character. It starts with & and ends with a semicolon. Named entities use a word, like & for & or © for ©. Numeric entities use the Unicode code point, either in decimal like © or in hex like ©. The browser replaces them with the real character when it renders the page, so the markup itself can stay plain ASCII.
Entities solve two problems. First, they let you show characters that HTML would otherwise read as markup: a literal < starts a tag and a bare & starts an entity. Second, they let you write characters your keyboard or file encoding can’t handle. HTML5 defines more than 2,000 named entities, and any Unicode character, including emoji like 🚀 for 🚀, can be written as a numeric one.
How to escape HTML in JavaScript
In the browser, the safest way to show user text is not to build HTML strings at all. Set element.textContent instead of innerHTML, and the browser treats the value as text. React, Vue, Svelte and Angular escape interpolated values by default too. The risk comes back the moment you use innerHTML, dangerouslySetInnerHTML or v-html with data you don’t control, which is where most XSS bugs in modern apps start.
When you do need an escaped string, for a template or an email body, replace the five special characters: the ampersand first, then <, >, the double quote and the single quote. Escaping & first matters, otherwise < turns into &lt;. That is what this HTML escape tool does in Encode mode, writing the single quote as '. Use Decode to check what a string from a database or API really contains.
Why do I see &amp; on my page? Fixing double escaping
If a page shows & or " as literal text, the string was escaped twice. Typically the value was escaped before it was stored, and the template escaped it again on output. The first pass turns & into &, the second turns that into &amp;, and the browser displays it as &. The same happens with RSS feeds, CMS fields and JSON APIs that escape HTML on your behalf.
The fix is to escape once, at the moment you write into HTML, and store raw text everywhere else. To clean up existing data, paste it in Decode mode: each pass removes one layer, so run it again if entities remain. Decoding uses the browser’s parser on a textarea element, which reads entities without running tags or scripts. To compare the before and after versions, use Text Diff.
Common HTML entities
Characters that need escaping in HTML, and the typographic ones people look up most often.
| Character | Named entity | Numeric entity |
|---|---|---|
| & | & | & |
| < | < | < |
| > | > | > |
| " | " | " |
| ' | ' | ' |
| no-break space | |   |
| © | © | © |
| ® | ® | ® |
| ™ | ™ | ™ |
| € | € | € |
| £ | £ | £ |
| ° | ° | ° |
| × | × | × |
| ÷ | ÷ | ÷ |
| – | – | – |
| — | — | — |
| … | … | … |
| « | « | « |
| » | » | » |
| → | → | → |
| ← | ← | ← |
| ✓ | ✓ | ✓ |
Something not working, or a result looks wrong? Report a problem with this tool