HTML Entities Encode and Decode
Convert special characters such as <, > and & to HTML entities, or decode named and numeric entities back to text. Runs in your browser.
Convert special characters such as <, > and & to HTML entities, or decode named and numeric entities back to text. Runs in your browser.
HTML treats characters like <, > and & as markup. To show them as text you replace them with entities such as <, > and &. Escaping also protects pages from injected markup when you display user input.
This tool encodes those characters and decodes named entities (like ©) and numeric entities (like © or 😀).
Input: <p>Tom & Jerry</p> Output: <p>Tom & Jerry</p>
An HTML entity begins with an ampersand and ends with a semicolon. It can be named, like & or ©, or numeric, written in decimal as © or in hexadecimal as ©. The browser parser turns each into the matching Unicode character. The five characters that most often need escaping are the ampersand, less-than, greater-than, double quote and single quote, since they can start markup or end an attribute value.
Where you escape matters. Text inside an element body mainly needs ampersand and less-than handled, while an attribute value in quotes also needs the quote character handled. Inside a script block or a URL attribute, HTML escaping alone is not enough, because those contexts follow different parsing rules. Also, escaping on input and again on output leads to double encoding, where visitors see literal text like &amp; on the page.
All numeric entities, and the commonly used named ones such as &, <, >, ", , © and €. Unknown names are left unchanged.
Escaping is one important part of preventing XSS, but how you escape depends on where the text is placed (HTML body, attribute, script). Use your framework's escaping.
Useful when a system cannot handle UTF-8. Each character becomes a numeric entity such as é.
No. It stays in your browser.
Yes. Numeric entities refer to Unicode code points, so © is always the copyright sign, whatever the page encoding. Named entities depend on the names defined in the HTML specification.
Browsers usually accept a raw greater-than in text, but escaping it is the safe habit. It keeps your output consistent and avoids problems in older parsers and in XML contexts.