HTML Entity Encoder & Decoder
Escape text for HTML and turn &entities; back into characters. Усе виконується локально — нічого не надсилається на сервер.
- Вхід
- Text · HTML
- Вихід
- Escaped HTML · decoded text
Text
pane.characters
HTML
pane.characters
<p class="note">Fish & chips — £4.50, café crème "très bon" 😀</p>
Escape text for HTML, or turn entities back into text
This HTML entity encoder escapes the characters that would otherwise be read as markup, and the decoder turns entities such as &, é and € back into the characters they stand for. Choose named, decimal or hexadecimal references, escape only what is necessary or every non-ASCII character, and look up common entities in the reference table. It all runs in your browser; nothing you paste is uploaded.
How to encode or decode HTML entities
- Choose Encode to escape text for HTML, or Decode to turn entities back into characters.
- When encoding, choose what to escape: only the special characters (
& < > " ') or also every non-ASCII character. - Choose the form: named (
é), decimal (é) or hex (é). - Copy the result, or swap it back into the input to check the round trip. Turn on Reference table to copy a single entity.
Why HTML needs escaping
In HTML, < starts a tag and & starts a character reference, and inside an attribute the quote character ends the value. To show those characters as text they must be written as entities: <, &, " and '. Forgetting to do so is how a stray "<b" in a comment makes the rest of a page bold — and, when the text comes from a user, how cross-site scripting (XSS) happens.
Escaping is the last line of defence, not the only one. Templating engines such as React, Vue, Jinja and Blade escape output for you; this tool is for the places they do not reach — static HTML, email templates, documentation, CMS fields and debugging what a system actually stored.
Named, decimal and hexadecimal references
The apostrophe is written as ' rather than ': ' is valid in HTML5 and XML but was never part of HTML 4, and some older parsers do not know it.
- Named (é)
- Readable, and the form most people recognise. HTML5 defines about 2,200 names, but not every character has one; characters without a name are written in decimal.
- Decimal (é)
- The Unicode code point in base 10. Works for every character, in every HTML and XML parser.
- Hexadecimal (é)
- The same code point in base 16, which matches how Unicode charts write it (U+00E9).
Do I need to escape accented letters and emoji?
Not on a page served as UTF-8, which is nearly every page today. Only the five special characters must be escaped; "café", "日本語" and emoji can be written as they are. That is what the only special characters option does, and it keeps the HTML readable.
Escaping every non-ASCII character is still useful when the output passes through something that is not UTF-8 safe: a legacy system in ISO-8859-1 or Windows-1252, some email pipelines, or a source file whose encoding you cannot control. The result is pure ASCII and survives any of them.
How decoding works
The decoder reads named references, decimal (©) and hexadecimal (©) ones, following the rules browsers use: numeric references in the range 128–159 are read as Windows-1252, as the HTML standard specifies, so – becomes an en dash; invalid code points become the replacement character; and the few legacy names browsers accept without a semicolon, such as ©, are decoded too. Unknown names, usually typos like &nbps;, are left in place and listed so you can fix them.
If the text came from a URL rather than from HTML, use the URL decoder instead: %3C is percent-encoding, not an HTML entity.
Поширені запитання
- What are HTML entities?
- HTML entities are codes that stand for characters, written between & and ;. They let you show characters that HTML would otherwise treat as markup, such as < and &, or characters that are hard to type, such as © or a non-breaking space.
- Which characters must be escaped in HTML?
- Five: & as &, < as <, > as >, the double quote as " and the single quote as '. The quotes only matter inside attribute values, but escaping them everywhere is harmless.
- How do I decode HTML entities?
- Choose Decode and paste the text. Named, decimal and hexadecimal entities are converted to characters as you type, and any unknown entity names are listed.
- What is the difference between and a normal space?
- is a non-breaking space: it looks like a space but stops a line from wrapping at that point, and browsers do not collapse several of them into one. It is useful between a number and its unit, such as 10 kg.
- Should I use ' or ' for an apostrophe?
- ' works everywhere. ' is valid in HTML5 and XML but not in HTML 4, so ' is the safer choice for email and older systems.
- Does escaping HTML prevent XSS?
- Escaping text before inserting it into HTML is the core defence against cross-site scripting, but it must match the context: HTML text, attributes, URLs and JavaScript each need their own encoding. Prefer a templating system that escapes automatically.
- Is my text sent to a server?
- No. Encoding and decoding happen entirely in your browser.