HTML Encode and Decode (HTML Entities)
Paste text to HTML-encode it, so &, <, >, " and ' show as text instead of being read as markup, or switch to Decode to turn entities such as < and é back into characters.
0 words 0 characters 0 lines
Continue with this text: Remove HTML tagsURL encoderBase64
Your text stays in your browser: nothing is uploaded or stored on a server.
How to use it
- Paste or type your text in the box, or press Example to load a short HTML snippet.
- Under Direction, choose Encode (< → <) to escape text for HTML, or Decode (< → <) to turn entities back into characters.
- When encoding, tick Encode every non-ASCII character (é → é) if the result must be plain ASCII.
- The result updates as you type. Press Copy, or Use as input to run it through another tool; Undo brings the previous text back.
What the encoder changes
The encoder always replaces the same five characters, and nothing else unless you tick the non-ASCII option:
| Character | Becomes | Why it matters |
|---|---|---|
& |
& |
Starts every entity, so it must be escaped first. |
< |
< |
Would start a tag. |
> |
> |
Ends a tag; escaped for symmetry and safety. |
" |
" |
Would end a double-quoted attribute value. |
' |
' |
Would end a single-quoted attribute value. |
These are the same five characters the OWASP cross-site scripting cheat sheet lists for HTML output encoding (it writes the apostrophe as ', which is the same character).
Spaces, tabs and line breaks are not touched, and an ampersand that already starts an entity is escaped again: & becomes &amp;. That is correct when you want the page to show the code &, and it is why you should encode raw text only once.
With Encode every non-ASCII character ticked, every character outside the basic 128 ASCII characters becomes a decimal reference built from its Unicode code point. Accents, curly quotes, dashes, symbols and the non-breaking space ( ) all change. An emoji is one code point in most cases, but a skin tone or a family emoji is several code points joined, so it becomes several references: 👍🏽 becomes 👍🏽. Use this option when a template, email system or database column only accepts ASCII; a page saved as UTF-8 does not need it.
Worked examples
Encoding the example text, with the option off and on:
Input: <p class="note">Fish & chips — "café" style</p>
Encoded: <p class="note">Fish & chips — "café" style</p>
ASCII only: <p class="note">Fish & chips — "café" style</p>
| Before | Direction | After |
|---|---|---|
AT&T |
Encode | AT&T |
x < y && y > z |
Encode | x < y && y > z |
It's |
Encode | It's |
naïve café |
Encode, ASCII only | naïve café |
→ ✓ • ♥ |
Encode, ASCII only | → ✓ • ♥ |
<p> |
Decode | <p> |
Rock &amp; Roll |
Decode | Rock & Roll |
😀 😀 |
Decode | 😀 😀 |
Tom’s — 5 € |
Decode | Tom’s — 5 € (with a non-breaking space) |
Decoding runs once, so double-encoded text such as &amp; loses one layer per pass. If text still shows & after decoding, press Use as input and decode again.
How the decoder reads entities
An entity starts with & and must end with ;. The decoder handles three forms:
- Decimal references such as
©and hexadecimal references such as©or©. As in a browser,�, the surrogate range (�to�) and numbers above 10FFFF become the replacement character�. - Named references: all 2,125 names in the HTML standard’s list that end with a semicolon, from
&, and©toé,→,✓and♥. Names are case-sensitive, as in HTML:Éis É andéis é,&is a listed name and becomes&, but&Amp;and&Copy;are not and stay as typed. - Anything else is left unchanged: unknown names, an
&with no semicolon (&orAT&T), and URL codes such as%3C, which belong in the URL decoder.
Numbers from 128 to 159 are read the way browsers read them, using the Windows-1252 replacement table in the standard, because text from old Windows and Word-based sites often contains them: € becomes €, – an en dash (–), ’ a curly apostrophe (’), and “ and ” the curly quotes “ and ”. The five numbers in that range with no replacement (129, 141, 143, 144 and 157) stay invisible control characters, as in a browser.
One difference from a browser remains: browsers also accept about a hundred old names without the semicolon, such as © 2020. This tool leaves those as typed; add the semicolon, or use the find and replace tool to fix them in bulk.
When you need it
- Showing code on a web page or in a CMS. To display
<div class="box">in a blog post or documentation, encode it first; otherwise the browser builds a real element and the code disappears. - Putting user text into an attribute. A product name such as
12" Pizza & Wingsbreakstitle="..."oralt="..."unless the quote and the ampersand are escaped. Keep attribute values in quotes. - Cleaning scraped or exported text. Feeds, CSV exports from a CMS and API responses often contain
&,"and'in place of the real characters. Decode them, and if the text still has tags, run it through Remove HTML tags, which can decode entities as it strips. - ASCII-only systems. Older email templates, XML feeds and databases that mangle accents accept
éwhere they would breaké.
Encoding is not enough on its own for every place in a page. OWASP warns that HTML entity encoding does not make text safe inside <script> blocks, event handler attributes such as onclick, CSS, or the protocol of a URL in href; each of those contexts needs its own kind of escaping or should not take outside text at all.
HTML entities vs URL encoding vs Base64
| Need | Use | <a & b> becomes |
|---|---|---|
| Show text as text on a web page | HTML encoding (this tool) | <a & b> |
| Put text in a link or query string | URL encoder | %3Ca%20%26%20b%3E |
| Store or send arbitrary data as ASCII | Base64 | PGEgJiBiPg== |
Each one reverses only its own format: decoding %26 here does nothing, and decoding & in a URL decoder does nothing.
Questions
What does HTML encode mean?
It replaces the characters that have a meaning in HTML with character references, so the browser shows them as text. In this tool & becomes &, < becomes <, > becomes >, the double quote becomes " and the apostrophe becomes '. Everything else stays as typed unless you tick the non-ASCII option.
How do I write an ampersand in HTML?
Write "&", so "AT&T" becomes "AT&T". A bare "&" often displays fine, but if the letters after it happen to form an entity name followed by a semicolon, the browser turns them into another character, so escaping every ampersand is the safe habit.
Does HTML encoding change spaces?
No. Ordinary spaces, tabs and line breaks are left as they are, because they are not special in HTML. " " is a different character, the non-breaking space; with the non-ASCII option ticked, a non-breaking space already in your text is written as " ".
Why does an entity stay unchanged when I decode?
The decoder knows every name in the HTML list that ends with a semicolon, so "é → ✓ ♥" becomes "é → ✓ ♥". An entity stays as typed if it has no semicolon ("© 2020"), if the name is misspelled, or if the capitals are wrong, because names are case-sensitive ("&Copy;" is not a valid name). Numeric references such as "é" and "→" always work.
Is HTML encoding the same as URL encoding?
No. HTML encoding writes "&" as "&" for a web page; URL encoding writes it as "%26" for a link or query string. A link inside an HTML attribute can need both. Use the URL encoder for the URL part.
How do I HTML-encode or decode in Python, C# or JavaScript?
Python has "html.escape()" and "html.unescape()" in its standard library, and .NET has "WebUtility.HtmlEncode" and "WebUtility.HtmlDecode" in "System.Net". In JavaScript, the encoder on this page is five replacements in a row, starting with "&" so the other entities are not escaped twice; the table under "What the encoder changes" lists them.
Is my text sent to a server?
No. Encoding and decoding run in your browser. The text is kept only in this browser tab so it is still there if you open another tool, and it disappears when you close the tab.