HTML Entity Encoder

Turn text into HTML entities, or turn entities back into text, with the escaping level you choose.

Runs on your deviceDeveloperWorkingNo account needed

What this tool does

HTML Entity Encoder walks your input one code point at a time and rewrites the characters that would otherwise be read as markup. The five that always change are the ampersand, the less-than and greater-than signs, the double quote and the apostrophe. Beyond those five, the What to escape setting decides how far it goes: minimal leaves everything else alone, named swaps in a readable entity wherever the table holds one, and the third level turns every character above ASCII into a numeric reference.

The named table carries 244 entities: 243 of the 252 that HTML 4 defines — so ©, —,  , é, the Greek letters, the arrows and the common maths symbols — plus ', which HTML 4 itself never had. The nine HTML 4 names left out are its rarest: ⟨, ⟩, ℵ, ℘, ℑ, ℜ, ϑ, ϒ and ϖ. The table is used in both directions, the one exception being the apostrophe, which encoding always writes as a numeric reference. Decoding also accepts decimal references such as — and hexadecimal ones such as ☕, and characters outside the basic plane are handled whole: an emoji becomes a single 😀 rather than a pair of surrogate halves, and comes back intact. A name the table does not know, such as the HTML 5 addition ⅇ, is left exactly as it was found instead of being guessed at or silently dropped.

Two things it does not do are worth knowing first. Escaping is not sanitising: the five characters are the right set for HTML text and for quoted attribute values, but they are not enough inside an unquoted attribute, inside a script block, or in a URL, where a different escaping rule applies — so this tool prepares text for a template, it does not make untrusted markup safe. And it has no memory of what is already escaped, so running encode over text that already contains entities escapes their ampersands again and café becomes café. Decode first if that is what happened. The work is done by this browser tab, so nothing is transmitted and no copy of your text is kept anywhere.

Decoding is deliberately strict about the closing semicolon. A browser parsing legacy HTML will decode &amp without one; this tool will not, and leaves the bare &nbsp untouched. That is the more useful behaviour when you are inspecting a fragment rather than rendering it, because it shows you the malformed reference instead of quietly repairing it.

How to use it

  1. Paste the text or the markup. Anything goes in the box — a paragraph of copy, an HTML fragment, or a line of entities you want read back. Load sample drops in a link tag carrying a bare ampersand, an em dash and curly quotes, which is material for the encode direction — to watch decoding, encode it first and put the result back.
  2. Choose the direction. Encode escapes characters into entities; Decode turns entities back into the characters they stand for. The escaping options only appear in the encode direction.
  3. Choose what to escape. Minimal for the five markup characters and nothing else, Named where a readable entity such as — exists, or the third level to push every non-ASCII character out as a numeric reference.
  4. Pick decimal or hexadecimal for numeric references. Off gives — and ', on gives — and '. Both decode identically; hexadecimal matches how code points are usually written down.
  5. Read the count, then copy. Encoding reports how many characters it escaped. Decoding reports how many entity references it found, and that total includes any it left in place, so a count larger than the number of visible changes means a name went unrecognised.

Processing & privacy

Runs on your device. Your file is processed directly in this browser.

Common use cases

Putting a code sample on a page

A snippet containing tags has to be escaped before it can be shown as text, or the browser renders it as markup and the example disappears.

Filling an HTML template with copy someone else wrote

Product blurbs and imported descriptions arrive with stray ampersands and quotes that break the surrounding attribute or element.

Reading a scraped or logged fragment

Log lines and API payloads often store markup pre-escaped. Decoding it once makes the actual content legible instead of a wall of < and >.

Getting dashes and accents through an old system

A CMS field or mail template that mangles anything above ASCII will carry — and é safely, which is what the numeric level is for.

Diagnosing double-escaped output

Seeing < on a live page means something escaped the text twice. Decoding it here shows which layer added the extra pass.

Questions

Does the text I paste leave the browser?
No. The whole conversion runs in this browser tab, so the text is not transmitted, logged or stored. The page keeps working with the network switched off, which is the simplest way to confirm it.
Why does the apostrophe come out as ' instead of '?
Because ' is not part of HTML 4 and older parsers do not recognise it, while the numeric reference is understood everywhere. The tool always writes the apostrophe numerically, as ' or ' if you have hexadecimal switched on.
Why was one of my entities left alone when decoding?
Two reasons cover almost every case. The name is not among the 244 the table holds — HTML 5 added roughly two thousand more, and nine HTML 4 names are absent as well, ⟨ and ⟩ among them — or the closing semicolon is missing, which this tool treats as malformed rather than repairing it.
Why did encoding turn é into é?
The encoder escapes every ampersand it meets, including the ones that begin an existing entity, so a second pass over already-escaped text double-escapes it. Run Decode first, then encode once.
Does escaping my text make it safe to insert into a page?
Not on its own. Escaping the five markup characters is correct for HTML text and quoted attribute values, but an unquoted attribute, a script block or a URL each need their own escaping. Treat this as a formatting step, not a security control.
Which escaping level should I choose?
Minimal for anything that will be served as UTF-8, which is nearly everything today, since accents and symbols need no escaping. Named when you want the source readable at a glance. Numeric when a downstream system mangles non-ASCII characters.
What happens to characters with no named entity?
At the named level they are passed through as themselves, with no numeric fallback — so an emoji or a rarer symbol stays literal. Choose the numeric level if you need every non-ASCII character escaped without exception.
How does this differ from URL Encoder Decoder?
Different escaping rules for different places. Entities protect characters from an HTML parser; percent-encoding protects them inside a URL. Text bound for a link needs the URL tool, not this one.

Related tools