HTML Entity Encoder/Decoder
Escape or decode HTML entities - free, no signup.
What this tool does
Type or paste your text, choose Encode or Decode. Encoding escapes the five characters that are structurally special in HTML (<, >, &, " and ') so text displays literally instead of being interpreted as markup, with an option to also escape every non-ASCII character as a numeric entity. Decoding reverses both named entities (like &) and numeric entities (both decimal © and hex ❤ forms) back to readable text.
Encodes text into safe HTML by escaping the characters that would otherwise be interpreted as markup.
Decodes HTML entities - both named (&, <, ©) and numeric (©, ❤) - back into readable text.
Optionally escapes every non-ASCII character (accents, symbols, emoji) as a numeric entity, useful for older systems with limited character-set support.
Encodes the apostrophe as the numeric ' rather than the named ', since ' wasn't part of the original HTML4 spec and some older parsers don't recognise it.
Decodes without touching the DOM, so it never routes your text through innerHTML the way many quick entity-decode snippets do - a pattern that can execute embedded markup instead of just reading it back as text.
How to use it
- Paste or type your text.
- Choose Encode or Decode.
- If encoding, turn on 'escape non-ASCII' if you need every special character represented as a numeric entity.
Why use this tool
Characters like < and & are read as markup, so they must be escaped when you display code or user text. Encoding and decoding by hand is slow and error-prone.
Why we built it
We built the HTML entity encoder and decoder to handle named and numeric entities in decimal and hex, not only the five basic ones. Check characters in the ASCII table and tidy markup with the HTML formatter.
Handy alongside this: the Base64 Encoder/Decoder and the Regex Tester.
Related tools worth a look: the Special Characters Picker.
Who this tool is for
- Web developers escaping markup
- Content editors fixing garbled symbols
- Students of HTML
When to use it
- Showing code samples in a web page.
- Escaping user text before display.
- Reading entity-heavy source or an email.
- Converting special characters to entities.
Why encoding matters for HTML output
Unescaped text can be silently interpreted as markup.
If a piece of text containing < or & is inserted directly into an HTML page without escaping, a browser can interpret it as the start of a tag or entity rather than literal text - at best displaying wrong, at worst creating a security hole if the text came from an untrusted source. Encoding the five structurally special characters (<, >, &, " and ') guarantees the text displays exactly as typed.
Why the apostrophe encodes as ', not '
A small inconsistency that trips people up when they compare output to another tool.
Of the five structurally special HTML characters, four have long-standing named entities everyone recognises: &, <, > and ". The apostrophe is the odd one out - ' is valid in XML and was only formally added to the HTML spec with HTML5, so a parser built against the older HTML4 spec, or a strict SGML-based tool, may not recognise it. Encoding the apostrophe as the numeric ' instead sidesteps the question entirely, since numeric character references have always been universally supported, which is why that's the more common choice in generated markup.
What you give it, and what you get back
| Item | Details |
|---|---|
| Input | Text to escape or entities to decode. |
| Output | Escaped markup-safe text or readable text. |
| Entities | Named and numeric entities. |
Issues you may run into
| What you see | Why it happens | What to do |
|---|---|---|
| An entity is not decoded | It is an obscure named entity. | Use its numeric form. |
| Double-encoded text | Text was escaped twice. | Decode once, check, decode again if needed. |
| Not a security fix | Escaping is one layer of defence. | Use proper templating and sanitising. |
Assumptions and limitations
- This escapes and unescapes the standard XML/HTML entity set plus a set of common named entities; a handful of obscure named entities beyond the standard set aren't recognised on decode.
- This is a text transform, not a full HTML sanitiser - it doesn't strip or validate tags, only escapes/unescapes entity characters.
Frequently asked questions
How do I encode HTML entities online for free?
Paste or type your text with Encode selected, and the special characters are escaped instantly. No signup, no upload.
What characters get encoded?
The five characters that are structurally special in HTML: < > & " and '. Turn on 'escape non-ASCII' to also convert accented letters, symbols and emoji to numeric entities.
Can this decode numeric entities like © or ❤?
Yes - both decimal (©) and hexadecimal (❤) numeric entity formats are decoded, alongside common named entities like & and ©.
Why would I need to encode HTML entities?
To safely display text that contains characters like < or & inside an HTML page without them being interpreted as markup, or to ensure older systems display special characters correctly.
Is my text uploaded anywhere?
No. Encoding and decoding happen entirely in your browser - nothing is sent to a server, and closing the tab clears it.
Why does encoding an apostrophe produce ' instead of '?
' wasn't part of the original HTML4 specification - it was only formally added in HTML5 - so some older or strict parsers don't recognise it. ' is the numeric reference for the same character (U+0027) and has always been universally supported.
Which named entities does the decoder recognize?
The core five (& < > " ') plus a set of commonly used ones: © ® ™ … — – ‘ ’ “ ” é and €. Any numeric entity, decimal or hex, decodes regardless of which character it represents.