Use it to escape html characters before inserting untrusted text into a page, or as a general html special characters converter whenever markup needs to travel safely as literal text. Get this wrong and one of two things happens. Under escaping lets a stray less than sign be interpreted as the start of a tag, which can silently break page layout or, far more seriously, allow a cross site scripting attack when the text comes from an untrusted source such as a user comment. Over escaping turns already safe punctuation into a wall of ampersand codes that makes content harder to read and edit.
Two encoding modes and when to use each
The five reserved characters mode escapes only what HTML actually requires: less than, greater than, ampersand, double quote and single quote. That is the minimum needed to safely place arbitrary text inside an HTML document without it being misinterpreted as markup, and it is the correct choice almost all of the time, since anything beyond those five characters displays correctly in any modern browser regardless of its character encoding.
The encode all non ASCII mode goes much further, converting every character outside the basic ASCII range, including accented letters, symbols and emoji, into numeric character references. This exists for compatibility with older systems, certain email templates and legacy content pipelines that cannot be trusted to declare or preserve UTF-8 correctly, where every non ASCII byte risks becoming garbled text known as mojibake if it is passed through as a raw character.
- Use reserved characters only mode for virtually all modern web content, since UTF-8 is the default everywhere today.
- Use encode all non ASCII mode only when a specific downstream system is known to mishandle UTF-8.
- Always escape user submitted text before inserting it into HTML, regardless of which mode you choose.
- Decode mode reverses both named entities, such as &, and numeric references, such as &.
Named entities versus numeric character references
A named entity, such as & for ampersand or © for the copyright symbol, is a mnemonic defined by the HTML specification for a specific character, chosen for readability in raw source code. A numeric character reference, such as & or the hexadecimal form &, represents the exact same ampersand by its Unicode code point instead, and every named entity has an equivalent numeric form even when the reverse is not true, since only a few hundred characters have a defined name.
This tool encodes using named entities for the small set of well known characters people actually expect to see, such as the five reserved characters and a handful of common symbols like the copyright and trademark marks, and falls back to numeric character references for anything else when encoding all non ASCII text. Decoding recognises both forms interchangeably, so pasted content using either style comes back correctly either way.
Why this matters for cross site scripting prevention
Escaping HTML special characters is one of the foundational defences against cross site scripting, commonly abbreviated XSS, where an attacker gets malicious markup or script executed in another user's browser by injecting it through a comment field, a username or any other input that ends up rendered as HTML without being escaped first. If the angle brackets in that injected input are converted to entities before being placed in the page, the browser displays them as harmless literal text instead of running them as a script tag.
This html entity encoder decoder is a manual tool for understanding and testing that escaping, not a replacement for doing it correctly and automatically in your application code, where a templating engine or framework should already be escaping output by default. Use this tool to see exactly what a given piece of text turns into, to debug why some markup is rendering incorrectly, or to prepare a small snippet of text for direct inclusion somewhere that does not auto escape.
How this html entity encoder decoder works
Encoding walks through the input character by character, checking each one against a lookup table of the common named entities before falling back to a numeric character reference for anything not in that table, or for every non ASCII character when that mode is selected. Decoding runs the reverse lookup, recognising both named entities and numeric references, including their hexadecimal variants, and reconstructing the original characters.
Everything runs as plain string processing in your browser with no HTML actually being rendered or parsed by the DOM at any point, so there is no risk of the tool itself executing anything you paste in, and no text you enter is ever sent anywhere else.
| Character | Named entity | Numeric reference |
|---|---|---|
| < | < | < |
| > | > | > |
| & | & | & |
| " | " | " |
| ' | ' | ' |
How to encode or decode HTML entities
- 1
Choose encode or decode
Pick whether you are escaping raw text or turning existing entities back into plain characters.
- 2
Choose the encoding scope
Escape only the five reserved characters for normal use, or all non ASCII text for legacy systems.
- 3
Paste your text
Enter the text or markup you want to convert into the input box.
- 4
Copy the result
Copy the escaped or decoded output directly, ready to paste into your document or code.
Related tools worth bookmarking
Sources and further reading
- WHATWG HTML: Named character referencesThe living standard's official table of every named HTML entity this tool recognises.html.spec.whatwg.org
- MDN: EntityBackground on how HTML entities work and why reserved characters must be escaped.developer.mozilla.org
- OWASP Cheat Sheet SeriesGuidance on output encoding as a core defence against cross site scripting attacks.owasp.org
Frequently asked questions
Common questions about the html entity encoder decoder.
They are less than, greater than, ampersand, double quote and single quote. Less than and greater than open and close tags, ampersand starts an entity reference, and the two quote characters delimit attribute values, so all five must be escaped whenever they appear as literal text rather than markup syntax.
Almost never. Modern browsers and servers overwhelmingly use UTF-8, which handles accented letters, symbols and emoji correctly without any escaping. Encoding all non ASCII text as numeric references is mainly useful for older email clients or legacy systems that are known to mishandle character encoding.
Escaping the five reserved characters correctly at every place untrusted text is inserted into HTML is the core defence against cross site scripting, but a complete defence also depends on context, such as whether the text lands inside an attribute, a script block or a URL, each of which has its own escaping rules beyond simple entity encoding.
A named entity like & is a readable mnemonic defined for a specific set of common characters, while a numeric character reference like & or & represents any character by its Unicode code point directly. Every named entity has an equivalent numeric form, but only a limited set of characters have an official name.
Only recognised entity syntax gets converted. A literal ampersand that is not followed by a valid entity name or a properly formed numeric reference is left exactly as typed, since treating an arbitrary ampersand as the start of an entity would risk corrupting text that never contained an entity in the first place.
No. All encoding and decoding is plain string processing that happens locally in your browser. Nothing you type or paste is transmitted anywhere, and the tool never renders your input as live HTML, so pasting untrusted markup in for inspection is safe.