Which characters does the encoder always escape?

Regardless of options, it always converts "&" to &, " " to >, the double-quote to ", and the single-quote to '. These are the characters that can break out of text into markup or attributes, so escaping them is what makes embedded content safe to display.

What does the "Use named entities" option change?

With it on, characters that have a friendly name in the tool’s common-entity table are emitted as that name — for example © becomes ©, € becomes €, and — becomes —. It covers roughly 40 frequently used symbols. Characters without a named form fall back to passing through or, if "Escape non-ASCII" is also on, to a numeric reference.

When should I enable "Escape non-ASCII"?

Turn it on when you need output that contains only ASCII characters — useful for systems or pipelines with limited charset support. Every code point above 127 is rewritten as a hexadecimal numeric reference like ©, so accented letters, symbols, and emoji are represented without any raw non-ASCII bytes.

Does decoding handle numeric references as well as named ones?

Yes. The decoder resolves named entities from its table and both numeric forms: decimal references such as © and hexadecimal references such as ©. Decoding uses String.fromCodePoint, so characters beyond the basic plane — including emoji — are reconstructed correctly rather than split.

Is this the full HTML5 named-entity set?

For encoding, named entities come from a curated list of about 40 common symbols rather than the entire HTML5 reference table. Decoding accepts that same common set plus all decimal and hexadecimal numeric references. If you need an exotic named entity that is not in the table, encode it as a numeric reference with "Escape non-ASCII".

Does escaping HTML protect against XSS by itself?

Escaping the HTML-significant characters before inserting untrusted text into page content is a core defense and removes the most common injection vector. It is not a complete XSS strategy on its own — context matters (attributes, URLs, scripts, and CSS each have their own rules), so combine it with proper output handling for those contexts.

HTML Entity Encoder / Decoder

Escape & unescape HTML entities — named or numeric, optional non-ASCII escaping, fuller decode table. Live.

About this ToolHow it works, benefits & use cases

Displaying code or user text inside an HTML page means escaping the characters the browser would otherwise treat as markup. This encoder always converts the five dangerous ones — "&", "<", ">", double-quote, and single-quote — into their entities so the content renders literally instead of becoming live tags. Two options extend that: "Use named entities" prefers readable names like ©, €, and — from a curated table of common symbols, while "Escape non-ASCII" turns every code point above 127 into a numeric &#xHEX; reference for maximum portability. The decoder reverses all of it, resolving named entities plus decimal ({) and hexadecimal ({) numeric references — and it is astral-safe, so emoji come back whole. Both directions update live as you type, you can swap input and output, and the conversion is captured in a shareable link. It all runs locally in your browser.

How to Use

1Choose Encode or Decode with the toggle at the top.
2When encoding, open Options to turn on "Use named entities" and/or "Escape non-ASCII" depending on the output you want.
3Type or paste your text or HTML into the input box — the escaped or unescaped result updates live below.
4Click "Encode entities" or "Decode entities" to confirm the conversion.
5Copy or download the output, use "Swap input ↔ output" to reverse it, or share the link.

Key Benefits

Always escapes the five HTML-significant characters (& < > " ') for safe display
Optional named entities (©, €, — …) from a curated common-symbol table
Optional non-ASCII escaping turns every char above 127 into &#xHEX;
Decoder resolves named plus decimal ({) and hex ({) numeric references
Astral-safe decoding so emoji and other surrogate-pair characters survive intact
Live two-way conversion with a one-click swap button
Shareable URL captures the input and options for handoff

Common Use Cases

Safely rendering code snippets or user input inside an HTML page
Preventing markup injection when echoing text into a template
Producing portable, ASCII-only HTML by escaping accented or symbol characters
Decoding entity-encoded content scraped from a page or pulled from a feed
Inserting special symbols like © or — as proper named entities in source

Options

Use named entities

Escape non-ASCII

Every char > 127 → &#x..;

Plain text / HTML

0 characters · live

Encoded output

Enter input above to see the result.

Was this tool helpful?

Share Your Experience

Help others discover this tool!

Share on

HTML Entity Encoder / Decoder

How to Use

Key Benefits

Common Use Cases

Options

Was this tool helpful?

Share Your Experience

Related tools

Frequently Asked Questions - HTML Entity Encoder/Decoder