HTML entity encoder and decoder
Escape text so it is safe to put in HTML, or turn entities back into characters exactly as a browser would. The full list of named references from the HTML Standard is built in.
tool 18 of 21 []
all shortcuts ?
How to use it
- Paste text and press Encode to escape it. The default escapes only the five characters that matter in HTML, which is what templating engines do and is safe in text and in quoted attributes.
- Choose named or numeric to also write every non-ASCII character as a reference, for systems that cannot store UTF-8. Named uses the shortest standard name, such as é, and falls back to numeric.
- Press Decode to turn references back into characters. The decoder follows the HTML parsing rules: it knows all 2231 names, the legacy forms without a semicolon, and how browsers treat invalid numeric references.
- Search by name, such as arrow, or paste a character to find its names and code points.
Which characters you actually need to escape
In HTML text you must escape & and <. Inside a quoted attribute value you must also escape the quote character you used. Escaping all five of & < > " and ' covers both contexts, which is why most template engines do exactly that and nothing more. Since pages are UTF-8, characters such as é or the euro sign can be written directly.
Escaping is about context. Text that will go into a script block, a style block, a URL or an unquoted attribute needs different rules, and HTML entity encoding alone does not make it safe. The OWASP Cross Site Scripting Prevention Cheat Sheet lists the rule for each context.
Browsers still accept 106 old names without the final semicolon, such as © and &, so © 2026 shows a copyright sign. That is why a URL like ?a=1©=2 written into HTML without escaping the & can turn into a stray symbol in text. In attribute values the parser leaves such a name alone when it is followed by = or a letter or digit, which this tool models with the attribute option.
Common named references
| Name | Character | Code point |
|---|---|---|
& | & | U+0026 |
< | < | U+003C |
> | > | U+003E |
" | " | U+0022 |
' | ' | U+0027 |
| (no-break space) | U+00A0 |
© | © | U+00A9 |
® | ® | U+00AE |
™ | ™ | U+2122 |
… | … | U+2026 |
– | – | U+2013 |
‘ | ‘ | U+2018 |
’ | ’ | U+2019 |
“ | “ | U+201C |
” | ” | U+201D |
€ | € | U+20AC |
° | ° | U+00B0 |
× | × | U+00D7 |
÷ | ÷ | U+00F7 |
← | ← | U+2190 |
→ | → | U+2192 |
✓ | ✓ | U+2713 |
Generated from the WHATWG named character reference list (entities.json, last modified 2025-11-12, retrieved 2026-10-21), vendored with this tool and checked entry by entry by its tests.
Examples
Select an example to load it into the tool.
- HTML snippet
<a href="/?q=fish&chips">Tom's "best" café</a> - Entities to decode
Fish & chips © 2026 €5 😀 – - Legacy, no semicolon
© 2026 & ¬it; - Find arrows
arr
Frequently asked questions
How many HTML entities are there?
The HTML Standard defines 2231 named character references. 2125 end with a semicolon and 106 are legacy spellings without one, kept so old pages still render.
Should I write ' or '?
Both work in HTML5. ' was not defined in HTML 4, so many escapers use ' for compatibility, and this tool does the same.
Why does € decode to a euro sign?
Numeric references from 128 to 159 are read as Windows-1252 code points for historical reasons, so € becomes the euro sign. References to 0, to surrogates or beyond U+10FFFF become the replacement character.
Is encoding enough to prevent XSS?
Only for HTML text and quoted attribute values. JavaScript, CSS and URL contexts need their own escaping, and attributes such as href also need the URL scheme checked.
Is anything uploaded?
No. Encoding and decoding happen in this tab, with the full entity list built into the page. The test suite fails the build if this tool contains a network call.
Sources
- WHATWG HTML Standard: Named character references checked 2026-10-21
- WHATWG HTML Standard: Character reference state (parsing rules) checked 2026-10-21
- WHATWG entities.json (machine-readable list) checked 2026-10-21
- OWASP Cross Site Scripting Prevention Cheat Sheet checked 2026-10-21