HTML Entity Encoder / Decoder

Escape special characters into HTML entities so they render as text instead of markup, or decode entities back into readable characters. Named and numeric forms both supported.

html-entities · runs locally

What HTML entities are and why they exist

HTML gives special meaning to a handful of characters: < starts a tag, & starts an entity, and quotes delimit attribute values. To display those characters literally — or to insert untrusted text without letting it become markup — you replace them with entities: &lt;, &amp;, &quot;. That substitution is the single most important defence against cross-site scripting, which is why every template engine escapes by default.

This tool encodes the five HTML-critical characters plus every non-ASCII character, preferring well-known named entities such as &copy;, &mdash; and &euro; and falling back to hex numeric references like &#x2192;. The decoder reverses all of it — around thirty common named entities plus any decimal or hex numeric entity. Everything runs locally in your browser.

How to encode or decode HTML entities

  1. Pick Encode or Decode at the top of the panel.
  2. Paste your text or markup into the input.
  3. Click the convert button and copy the result.

Entities vs other encodings

Entity encoding is context-specific: it protects text inside HTML, and nothing else. Data going into a query string needs the URL Encoder instead, and binary payloads travel as Base64. Modern UTF-8 pages rarely need entities for accented letters or emoji — those can appear literally — so in practice you escape the structural five (& < > " ') everywhere, and reach for the rest when a document must survive an ASCII-only pipeline.

Frequently asked questions

When do I have to escape HTML?

Any time user-supplied or external text is inserted into an HTML page. Unescaped < > & " ' characters let attackers inject markup and scripts — the classic cross-site scripting (XSS) vulnerability. Escaping turns <script> into &lt;script&gt;, which the browser displays as text instead of executing. Comments, usernames, search terms and CMS fields all need it.

What is the difference between named and numeric entities?

Named entities like &copy; are human-readable mnemonics defined by the HTML spec; numeric entities like &#169; or hex &#xA9; reference the Unicode code point directly and work for every character, including ones with no name. This encoder prefers common named entities for readability and falls back to hex numeric form for everything else.

How is HTML entity encoding different from URL encoding?

They protect different contexts. HTML entities (&amp;, &lt;) make characters safe inside HTML markup, while URL percent-encoding (%20, %3F) makes characters safe inside a web address. A link with a query string often needs both: percent-encoding for the URL itself, then entity encoding when that URL is placed in an href attribute.

Is &nbsp; the same as a normal space?

Visually yes, behaviorally no. &nbsp; is a non-breaking space (U+00A0): browsers will not wrap a line at it, and unlike normal spaces, consecutive non-breaking spaces are not collapsed. Use it to keep units glued to numbers (10 km) — but avoid using runs of it for layout, which is what CSS is for.

URL Encoder / Decoder

Percent-encode URLs and query strings, or decode them back to plain text.

Open tool →

Base64 Encode / Decode

Encode text to Base64 or decode Base64 back to text. Full UTF-8 support.

Open tool →

Markdown to HTML Converter

Convert Markdown to clean HTML with a live rendered preview.

Open tool →