HTML entity encoder / decoder
Escape HTML special characters or decode named and numeric references as safe plain text, with a live preview.
How it works & useful details
How to use this tool
Encode special characters or every character; switch to Decode to read character references as text.
Details and limits
Decodes all HTML5 named character references with a semicolon, plus decimal and hexadecimal Unicode scalar references. Unknown references and references without semicolons are unchanged. Decoding is one pass, and rejects NUL, surrogate, or out-of-range numeric references. This is character-reference conversion, not HTML parsing or legacy numeric-code remapping.
Tags and scripts are displayed as text and never inserted as HTML. Up to 100,000 input code units; live preview up to 8,000.
About this tool
HTML entity encoder / decoder escapes HTML special characters or decodes named and numeric references. It is the tool for preparing text that must display literally, or for reading text that arrived full of entities.
Decoded output is shown as plain text, never injected as markup, so pasted content cannot run in your browser. Encoding and decoding both happen locally.
How to use it
- Choose to encode special characters or decode existing entities.
- Paste the text or HTML fragment.
- Check the live preview and the escaped or decoded output.
- Copy the result into your document or template.
Worked example
Encoding special characters turns
<a href="x">Tom & Jerry</a>into
<a href="x">Tom & Jerry</a>which displays the tag literally on a web page instead of creating a link. Decoding reverses the process. Named references like é, decimal references like é, and hexadecimal references like é all decode to é.
When to escape, and when it is not enough
Escape text whenever you place user-provided or untrusted content into HTML: the five characters & < > " ' are enough to stop it being read as markup inside element content and quoted attributes. Modern templating frameworks such as React, Vue, and most server template engines do this automatically. Manual escaping matters for hand-built HTML strings, email templates, and documentation that shows code.
HTML escaping does not make text safe everywhere. Inside a <script> block, a style attribute, or a URL such as href="javascript:…", different rules apply. Each context needs its own encoding, and URLs need to be validated as well. Use "encode every character" only when you need to hide non-ASCII characters from a system that mishandles them. It makes the source much harder to read.
Frequently asked questions
Which characters are escaped when encoding?
The characters that change how HTML is parsed, such as ampersands and angle brackets, plus quotes where they would break an attribute.
Are numeric character references supported?
Yes. Both decimal and hexadecimal numeric references are decoded alongside the common named entities.
Is the preview safe for untrusted HTML?
The preview treats input as text, so scripts and markup cannot execute.
Why is &nbsp without a semicolon left unchanged?
Browsers accept some legacy references without a semicolon, but the rules are inconsistent. The decoder only converts complete references that end in a semicolon, which keeps the result predictable.