Free HTML Entity Encoder & Decoder
Escape &, <, > and quotes as named, decimal or hex entities — or decode any HTML entity back to readable text. Fully offline in your browser.
Your Input
Encoded Output
No output yet
Start typing in the left panel to see the resultWhat Are HTML Entities?
HTML entities are codes that represent characters which would otherwise be interpreted as markup, or that cannot be typed directly. They start with an ampersand and end with a semicolon. When a browser renders your HTML, every entity is replaced with the character it represents before the page is displayed.
There are three ways to write the same entity, and this tool can produce any of them:
| Form | Example | Renders as |
|---|---|---|
| Named | < | < |
| Decimal | < | < |
| Hex | < | < |
All three are equivalent — the browser renders them identically. Named entities are the most readable and are what most source code uses. Decimal and hex forms are more verbose but work for every Unicode code point, including characters that have no named entity.
The five characters you must escape
Every HTML document should escape at least these five characters, because each one has special meaning in HTML markup:
| Character | Entity | Why it matters |
|---|---|---|
& | & | Starts every entity — a bare ampersand can be misread |
< | < | Opens a tag |
> | > | Closes a tag |
" | " | Terminates a double-quoted attribute |
' | ' or ' | Terminates a single-quoted attribute |
Everything else — letters, digits, most punctuation — can be left as literal characters in a UTF-8 document. That's what the tool's Minimal mode does.
When to use named vs numeric entities
| Form | Best for | Downside |
|---|---|---|
| Named | Hand-written HTML, documentation, editable source | Only ~2,000 named entities exist — not every character has one |
| Decimal | Automated output, wide character coverage | Longer, harder to read |
| Hex | When you already know the code point (e.g. U+2764 → ❤) | Requires hex fluency |
Common HTML entities cheat sheet
| Character | Named | Decimal | Hex |
|---|---|---|---|
| & | & | & | & |
| < | < | < | < |
| > | > | > | > |
| " | " | " | " |
| ' | ' | ' | ' |
| (space) | (non-breaking) |   |   |
| © | © | © | © |
| ® | ® | ® | ® |
| ™ | ™ | ™ | ™ |
| € | € | € | € |
| → | → | → | → |
| ❤ | ♥ | ♥ | ♥ |
Why escape HTML at all?
- Prevent XSS injection. If user input is echoed into HTML without escaping, a malicious
<script>tag runs in other users' browsers. Escaping<as<renders it harmlessly as text. - Display code samples. To show
<div>on a page without the browser rendering it as a div, you have to write<div>. - Escape ambiguous characters. An ampersand inside a URL parameter (
?a=1&b=2) is ambiguous — writing&removes the doubt. - Represent characters outside the document charset. Before UTF-8 was universal, entities were the only way to include non-ASCII characters safely. They still matter in email, XML and RSS feeds.
Common use cases
Escape User Input
Sanitize text before inserting it into HTML to prevent XSS.
Show Code Samples
Display HTML markup on a page without the browser rendering it.
Read Source Code
Decode entities in third-party HTML you're trying to read.
Email & RSS
Email clients and RSS feeds often prefer entities over UTF-8.
XML Compatibility
XML only defines five named entities — numeric ones fill the gap.
Database Cleanup
Decode entities that were stored literally by an importer.
Query String Safety
Escape & and = inside query parameter values.
CMS Content
Bypass rich-text editors that strip literal special characters.
Privacy and security
This HTML entity converter runs entirely in your browser. Encoding and decoding use JavaScript string operations and a built-in entity lookup table — no network requests, no server, no analytics on your input. Safe for API keys, customer data, internal HTML and anything else you would rather not paste into a stranger's server.
Frequently Asked Questions
What are HTML entities?
< represents a less-than sign, & represents an ampersand, and © represents the copyright symbol.Is this HTML entity converter free?
Is my data sent to a server?
What is the difference between named, decimal and hex entities?
< or and are the most readable form. Decimal entities use the Unicode code point in base 10, written as < for a less-than sign. Hex entities use base 16 with an x prefix, written as <. All three forms are equivalent and every modern browser renders them identically.Which characters must be escaped in HTML?
&), the less-than sign (<), the greater-than sign (>), the double quote (") and the single quote or apostrophe (' or '). The first two are essential because they begin markup; the quotes matter when their content appears inside an attribute value.Do I need to escape every special character?
©, ® and ™ work fine as literal characters in UTF-8 documents, and the tool's Minimal mode escapes only the five unsafe characters to keep the output clean and readable.What is and should I use it?
is a non-breaking space (U+00A0). It looks like a regular space but prevents the browser from wrapping between the two words it separates. It is useful for keeping units together like 10 kg, but overusing it breaks text reflow on mobile and harms accessibility, so use it sparingly.Why does my decoded text still contain &?
&lt; decodes once to < and needs a second pass to become a literal < character. Paste the result back into the decoder and run it again, or enable the tool's strict decode toggle for an automatic second pass.Should I escape quotes in HTML?
", and in single-quoted attributes escape '. This tool escapes both by default so the output is safe in either context.Will escaped HTML still render correctly in a browser?
<strong>Hello</strong> displays as the literal text <strong>Hello</strong> rather than rendering bold text. This is exactly what you want when displaying code samples, user-generated content or documentation.