HTML Encoder and Decoder: Escape HTML Entities

How to use the html encoder decoder

1. Paste your text into the Text field.
2. Choose Encode (escape) to convert special characters to HTML entities, or Decode (unescape) to convert entities back to characters.
3. If encoding, optionally check the box to also convert non-ASCII characters like accented letters into numeric entities.
4. The result appears immediately below as you type.

How HTML encoding works

An HTML encoder replaces characters that have special meaning in markup with their entity equivalents. The five characters required by the XML specification are always escaped:

• & becomes & (this must be replaced first to avoid double-encoding)
• < becomes <
• > becomes >
• " becomes "
• ' becomes '

For example, the string <b>A & B</b> encodes to <b>A & B</b>. When a browser parses the encoded version inside an element, it displays the literal tags rather than interpreting them as markup.

Decoding named and numeric entities

The HTML entity decoder reverses the process. It recognises three formats of references:

• Named entities such as © for the copyright symbol or   for a non-breaking space.
• Decimal numeric references like ©, where 169 is the Unicode code point in base 10.
• Hexadecimal numeric references like ©, where A9 is the code point in base 16.

All three of those examples decode to the same character: ©. Unknown named entities are left exactly as they appear in the input, preventing accidental data loss. Names are case-sensitive, so < decodes but ≪ does not. Numeric references that cannot be a real character (zero, lone surrogates or values above U+10FFFF) become the replacement character U+FFFD, and the prefix may be written &#x or &#X. Decoding is performed in a single pass, so < becomes < rather than being decoded twice to <.

Common HTML entities reference

This table lists the entities most frequently used when you need to escape HTML or insert special symbols.

When to escape HTML

You need to escape HTML whenever user-supplied or dynamic text is inserted into a web page. Failing to do so allows cross-site scripting (XSS) attacks, where an attacker injects <script> tags or event handlers. Server-side templating engines usually handle this automatically, but when building strings manually in JavaScript or preparing content for a CMS, an HTML encoder is essential.

Another common use case is displaying code snippets. If you write a tutorial about HTML itself, every angle bracket and ampersand in your examples must be escaped so the browser renders them as text instead of interpreting them as elements. For structured tabular data you might combine this tool with an HTML table generator to build the surrounding markup safely.

Encoding non-ASCII characters

Modern HTML documents using UTF-8 can include characters like é, ñ or € directly without issues. However, some legacy systems, email templates or strict XML parsers require every character outside the basic ASCII range (code points 0 through 127) to be represented as a numeric entity. Enabling the non-ASCII option converts each such character to its decimal code point, so an emoji becomes one reference such as 😀 instead of two surrogate halves. For instance, é (code point 233) becomes é.

This does not affect the five core XML characters, which are always encoded regardless of this setting. It simply extends the replacement step to cover the rest of the Unicode range present in your input.

Worked examples