How to encode or decode HTML entities
- Choose Encode to turn special characters into entities, or Decode to turn entities back into characters.
- Paste your text or HTML into the top box. In Encode mode you may tick Encode all non-ASCII to convert every character above code 127 to a numeric entity.
- The result updates as you type. Click Copy to take it.
What an HTML entity is
An entity is a text code that stands for a character, written as &name; or as a number such as © (decimal) or © (hexadecimal). Browsers replace it with the real character when displaying the page. Entities exist because some characters have a job in HTML itself: < opens a tag and & starts an entity. To show those characters as text, you must write them as entities.
The five characters this tool encodes
&becomes&<becomes<>becomes>"becomes"'becomes'
Inside ordinary page text only & and < strictly need escaping, but quotes matter inside attribute values such as title="...", and escaping all five is the safe habit. For example <a href="x?a=1&b=2"> encodes to <a href="x?a=1&b=2">.
Decoding: what is and is not recognised
Decoding handles every decimal and hexadecimal numeric entity up to U+10FFFF, plus a built-in list of about 35 common named ones: the five above, , ©, ®, ™, …, dashes, curly quotes, €, £, fractions and a few more. Anything outside that list, such as é or ♥, is left unchanged rather than guessed at; the numeric form (é) always works. An entity must end in a semicolon to be decoded, and decoding is a single pass, so &lt; becomes < and not <.
Common mistakes
- Double encoding. Encoding text that is already encoded turns
©into&copy;, which shows on the page as the literal text “©”. If you see that, run Decode once. - Encoding emoji with the non-ASCII option. Characters outside the basic plane are stored as two code units, and this option encodes each half separately, which browsers cannot display. Leave the option off for emoji and save your page as UTF-8 instead.
- Treating encoding as full security. Escaping is right for text and attribute values, but code inside script blocks or URLs needs different escaping.
Is it safe? Does it run the HTML?
No. Decoding never renders your input. Named entities are looked up in a fixed map and numeric ones are converted with a pattern match, so pasted markup is never parsed or executed. Everything runs in your browser, and your text is never uploaded.
Related guides
Web addresses use a different escaping scheme, covered in how to URL-encode text and the URL encoder. For data formats, see JSON escape characters, and to preview rendered content try the Markdown preview.
Frequently asked questions
What is the difference between encode and decode?
Encode turns special characters into HTML entities so they display as text. Decode turns entities such as < and © back into the original characters.
Why encode angle brackets?
Encoding the less-than and greater-than signs stops a browser reading them as tags, so a snippet like a div is shown as visible text instead of being rendered. Ampersands need encoding for the same reason, since they begin entities.
Which characters are encoded?
The five special characters: ampersand, less-than, greater-than, double quote and apostrophe, which becomes '. The optional non-ASCII setting also converts every character above code 127 to a decimal numeric entity.
Why are some named entities not decoded?
Decoding uses a built-in list of about 35 common names, plus all numeric entities. Names outside the list, such as the one for e with an acute accent, are left as they are. Use the numeric form, for example é, which always decodes.
Why does my text show & or &copy; on the page?
That is double encoding: the text was escaped twice, so the browser displays the first layer as literal characters. Run Decode once to undo one layer.
Does the non-ASCII option work for emoji?
It is not suitable for emoji. Emoji are made of two code units and each is encoded separately, which produces invalid entities. Keep your page in UTF-8 and leave the option off for them.
Does this tool run or execute the HTML?
No. Decoding uses a lookup map and a numeric pattern, not rendering, so nothing in your text is parsed or executed as HTML.
Is my text private?
Yes. Encoding and decoding run entirely in your browser and your text is never uploaded.