Skip to content
cliplimeClipLime

Encode and decode HTML entities

Escape &, < and > for HTML, or turn &eacute; and &#233; back into characters.

Your text stays in your browser

0 characters, 0 lines

Options

Escaping non-ASCII characters is only needed for old systems that cannot handle UTF-8.

Named entities are easiest to read. Numbers work for every character.

Leaves &amp; and &#233; alone instead of turning them into &amp;amp; and &amp;#233;.

What always gets escaped, and why

  • &&amp;Starts every entity, so a bare & can be read as the start of one.
  • <&lt;Starts a tag. Unescaped, it can turn text into markup.
  • >&gt;Ends a tag. Not strictly needed in text, but always escaped for safety and symmetry.
  • "&quot;Ends an attribute value written in double quotes.
  • '&#39;Ends an attribute value written in single quotes. &#39; works in every version of HTML.

At a glance

What it does
Turns characters into HTML entities and back again, as you type.
Escapes
The five characters HTML needs (& < > " '), or every non-ASCII character, or every character.
Styles
Named (&eacute;), decimal (&#233;) or hex (&#xE9;).
Decoding
All 252 HTML 4 names, decimal and hex numbers, and the longer HTML 5 names your browser knows. A table lists every entity found.
Like a browser
Invalid numbers become the replacement character U+FFFD, and numbers 128 to 159 are read as Windows-1252, as HTML parsers do.
Reference
A searchable list of the 252 HTML 4 named entities with their numbers.
Privacy
Your text stays in your browser.

How to do it

  1. 1

    Choose Encode or Decode

    Pick the direction at the top of the tool.

  2. 2

    Paste your text

    Paste HTML or plain text. The result updates as you type.

  3. 3

    Set what to escape

    When encoding, choose the five essential characters, all non-ASCII characters or everything, and named, decimal or hex entities.

  4. 4

    Copy the result

    Copy it, or download it as a file. The panels below show which entities were written or found.

The five characters that matter

HTML gives a few characters special jobs, so they have to be written as entities when you mean them as plain text:

  • & starts every entity, so a bare & can be read as the start of one. It becomes &amp;.
  • < starts a tag. It becomes &lt;.
  • > ends a tag. It becomes &gt;.
  • " ends an attribute value written in double quotes. It becomes &quot;.
  • ' ends an attribute value written in single quotes. It becomes &#39;.

Strictly, text content needs only & and < escaped, and an attribute in double quotes needs only & and ". Escaping all five everywhere is simple and always safe.

Named, decimal and hex entities

&eacute;, &#233; and &#xE9; are three ways to write the same character, é. A named entity is easy to read, but only some characters have a name: HTML 4 defines 252, and HTML 5 adds a few thousand more. A numeric entity works for every Unicode character, in decimal after &# or in hex after &#x.

This tool writes &#39; for the apostrophe instead of &apos;. HTML 4 does not define &apos;, so numbers are the version that works everywhere.

Do you need to escape non-ASCII characters?

Usually not. If a page is saved as UTF-8 and declares it, with <meta charset="utf-8"> or a matching Content-Type header, é, 你 and emoji can be written directly. Escape non-ASCII characters only when the text has to travel through something that cannot carry UTF-8, such as a very old system or an ASCII-only file.

Entities are still useful for characters that are invisible or easy to confuse. &nbsp; is a space that does not break a line, and &shy; marks a place where a long word may be hyphenated. Writing them as entities makes them visible in your source.

Escaping is not the same as sanitizing

Writing <script> as &lt;script&gt; makes a browser show the text instead of running it, which is exactly right for text that goes in the body of a page. But the correct escaping depends on where text lands: the HTML body, an attribute, JavaScript, a URL and CSS each need their own method. Use your template engine's automatic escaping, and treat a converter like this one as a way to look at and fix individual strings.

Questions people ask

What does &amp;amp; mean?

The & in &amp; was escaped a second time, so the text was encoded twice. Decode it once to get &amp;, and again to get &. Turn on Keep entities that are already there when encoding to avoid it.

What is the difference between &#233; and &#xE9;?

Nothing. Both are the character é, with the number 233 written in decimal and then in hex (E9). Browsers treat them identically.

What is &nbsp; and when should I use it?

It is a non-breaking space, character number 160. It looks like a space but keeps two words on one line and does not collapse with spaces next to it. Use it for small things like a number and its unit, and use CSS for layout spacing.

Why does the tool write &#39; and not &apos;?

&apos; exists in XML and HTML 5 but not in HTML 4, and some old software does not understand it. &#39; works everywhere.

Why was an entity left as it was when decoding?

Only names HTML knows are decoded, and only when they end with a semicolon. A made-up name such as &bogus;, or text such as AT&T, is left exactly as typed.

Is my text sent anywhere?

No. Encoding and decoding happen in your browser and nothing is uploaded.

Guides that help

All Data and developer guides →

Data and developer

That long token is readable by anyone, so where you paste it matters. Decode a JWT and read it safely

6 min readRead

Data and developer

Base64 looks like encryption and is not. What it does, why it exists and why your decode fails

6 min readRead

Pairs well with

URL Encoder and Decoder

Percent-encode and decode URLs, and split a URL into parts and a table of query parameters.

Open tool

Base64 Encoder and Decoder

Encode and decode Base64 for text, files and images, with URL-safe and line wrapped options.

Opens Text, any file, Base64 strings · Saves Base64 text, decoded files

Open tool

HTML Formatter

Indent and beautify HTML, including the CSS and JavaScript inside it.

Opens HTML · Saves HTML

Open tool

JWT Decoder

Decode a JSON Web Token and read its claims and dates, with an optional local HS256 signature check.

Open tool