🏷️ HTML Entity Encoder / Decoder

🏷️ What are HTML entities?

An HTML entity (formally a character reference) is a short code that stands in for a character that would otherwise be ambiguous or hard to type. There are two kinds: named references such as & or ©, and numeric references such as & (decimal) or & (hexadecimal).

Entities exist because five characters are part of HTML's syntax itself. When your data contains a literal <, the parser cannot know whether you meant "start a tag" or "show a less-than sign" — unless you escape it. That is the whole job of an HTML entity encoder, and it is why escaping runs in the opposite direction to what most people expect: the encoder makes text safe to display, not hidden.

🔐 The five characters you must escape

Every other character — accents, currencies, arrows, CJK, emoji — is safe to put in an HTML document as long as the file is encoded as UTF-8, which is the default in every modern browser and editor. Escaping them is optional and only useful when the encoding is uncertain.

🔢 Named vs numeric entities

Named entities read better (© beats ©) but they are not uniform. The HTML 4.01 set defines  , —, α, € and around 250 others, while most Unicode characters have no name at all — there is no &chineseletter;.

Numeric references work for everything by definition. This tool's encoder therefore uses a name when one exists in the classic set and falls back to a numeric reference otherwise, so the output is always valid HTML rather than an invented name that no browser recognises. If you need to be certain — for a strict XML consumer, for example — use Decimal or Hex mode, where every non-ASCII character becomes a numeric reference.

📋 HTML entity cheat sheet

The entities that appear in real documents, ordered by how often you will want them:

The decoder in this tool knows the full HTML 4.01 set — Greek letters, mathematical operators, arrows, punctuation, Latin-1 accented letters and the currency symbols — and records the name it matched for every entity it decodes.

🚀 How to use this tool

1. To escape: paste the text, choose a mode and press Escape. Minimal mode escapes only the five dangerous characters (what you want for user input); Named, Decimal and Hex add entities for non-ASCII characters; Everything turns every character into a numeric reference.
2. To unescape: paste the HTML and press Unescape. Named entities, decimal references, hex references and the legacy no-semicolon names are all decoded. Double-encoded text (<) is decoded twice and reported.
3. Read the table: every entity in the input is listed with the character it becomes, its code point and its name — useful when you are looking at someone else's markup and cannot tell what  is.
4. Unknown entities are left alone rather than silently turned into question marks, and they are reported in the status line so you can fix the source.

⚠️ The legacy no-semicolon quirk

HTML's entity rules were written before anyone enforced the trailing semicolon. Browsers therefore accept a set of legacy names without one — &amp, &copy, &nbsp all still work — and they match the longest valid name they can find.

That produces a genuinely surprising result: ∉ (which should be ∉) can be read as the legacy &not (¬) followed by the letters in;. The same trap sits in &copycat (©cat) and any text where an ampersand is followed by a word. The decoder in this tool reproduces the browser behaviour on purpose — if you want the literal ampersand, write &. That is also the rule for your own data: escape every ampersand, and none of this can bite you.

💼 Use cases

• Debugging double escaping: the page displays & because it was escaped three times somewhere in the pipeline — this tool shows you how many decode passes are needed.
• Writing CMS content: paste text with accents, quotes or an ampersand and get markup-safe HTML for a template field.
• Email templates: HTML email clients are the strictest parsers you will meet; unescaped & characters in URLs break links.
• Reading scraped HTML: decode entities from a page source or a feed into readable text.
• XSS review: encode a suspicious payload and see what a correct escaper produces, which makes it obvious when a template skipped it.
• Data cleanup: strip   and typographic entities from imported text before storing it.

❓ Frequently asked questions

Which characters must be escaped in HTML?

&, <, >, " and ' — as &, <, >, " and '. Everything else is safe in a UTF-8 document.

What is the difference between A and A?

Nothing but the base: A is decimal, A is hexadecimal, and both mean A. Numeric references work for every Unicode character, which is why the encoder uses them whenever no common name exists.

Does escaping HTML entities prevent XSS?

Escaping untrusted text before it lands in HTML or an attribute is the correct defence for that context, and it is what this tool produces. It is not sufficient in JavaScript, CSS or URL contexts, and it is irrelevant to SQL injection — escaping is one layer of a defence-in-depth approach, not a sanitizer.

Why did ∉ turn into ¬in?

Because of the legacy entity rule: the parser matched the no-semicolon name &not (¬) and left the rest as text. Browsers do the same. Escape your ampersands as & and it cannot happen.

Is my text uploaded anywhere?

No. Encoding, entity matching and decoding all run in your browser against a built-in table — you can load the page, disconnect and keep working.

🔗 Related tools

More free developer tools from DevToolBox: