What HTML Entities Are
HTML uses special characters for markup, such as angle brackets and ampersands. If you
want to display those characters as text, they must be escaped as HTML entities. Entities
also represent characters that are hard to type or that need to survive systems with
limited character sets. Examples include < for a less-than sign and
& for an ampersand.
This tool encodes special characters or non-ASCII text and decodes named or numeric entities back to plain text. Everything runs locally in your browser.
Encoding Modes
- Special characters: escapes
&,<,>, quotes and apostrophes. - Non-ASCII (decimal): converts accented letters, symbols and emoji to decimal entities.
- Non-ASCII (hex): converts the same characters to hexadecimal entities.
Special-character mode is the safest choice when inserting user-generated text into HTML. Numeric modes are useful when you need ASCII-only output for legacy systems or email templates.
When to Encode
Encode when you are inserting text into an HTML document, an attribute or an email template and you want to display it literally. This prevents browsers from treating user input as markup. It is not a substitute for a full sanitizer when you are rendering untrusted HTML; it only handles the characters that need escaping.
Decoding
The decoder handles common named entities such as &,
© and , as well as numeric entities like
© and 😀. This is useful for reading
escaped HTML, inspecting scraped content or cleaning values before storing them.
Named vs Numeric Entities
Named entities such as © are easier for humans to read, while
numeric entities such as © or © work
everywhere and are useful for characters without a convenient name. Both decode to the
same character. Choose the form that matches the system you are targeting.
Common Mistakes
- Double-encoding: turning
&into&amp;. - Encoding inside a context that expects raw text, which displays the entity literally.
- Assuming encoding makes untrusted HTML safe; use a sanitizer for markup.
- Encoding characters that are already valid in the target character set.
Privacy
Encoding and decoding run locally in your browser. Your text is not uploaded or stored. Need percent-encoding instead? Use the URL Encoder / Decoder. Working with binary text? Try the Base64 Encoder / Decoder.
Related Tools
Escape URLs with the URL Encoder / Decoder, decode tokens with the Base64 Encoder / Decoder, or format structured data with the JSON Formatter.