Skip to main content
ToolsBay

HTML Entity Encoder

Escape characters to HTML entities, or decode entities back to text.

Runs entirely in your browser — nothing is uploaded

Raw text

1 line

Escaped output

1 line

Frequently asked questions

Which characters actually need escaping?

Five: & < > " and '. The ampersand must be escaped first or you double-escape everything else. Quotes matter because unescaped ones let text break out of an HTML attribute — the exact failure escaping exists to prevent.

Does decoding handle named entities like &nbsp;?

Yes. Named references (&amp; &nbsp; &copy;), decimal references (&#38;) and hexadecimal references (&#x26;) are all decoded, including astral-plane code points such as emoji.

Is escaping here enough to stop XSS?

It is the right escaping for text placed into HTML body content or a quoted attribute. It is not sufficient inside a <script> block, inside a URL, or in a CSS context — those need their own escaping rules. Escaping is also no substitute for not injecting untrusted markup in the first place.

Why HTML entities exist

HTML gives special meaning to a handful of characters. A < starts a tag, an & starts an entity reference, and a quote closes an attribute value. To display those characters as text rather than have the browser act on them, they have to be written as references — &lt;, &amp;, &quot;.

Getting this wrong is how cross-site scripting happens. If user-supplied text containing <script> is written into a page unescaped, the browser runs it. Escaping turns it into inert text that displays as typed.

The three reference formats

  • Named — &copy;, &nbsp;. Readable, but only a fixed list of names exists.
  • Decimal — &#169;. Works for any Unicode code point.
  • Hexadecimal — &#xA9;. Same, written in hex, which matches how code points are usually documented.

Extended mode escapes every non-ASCII character as a numeric reference. That is occasionally required by systems that cannot carry UTF-8, but for a modern page serving charset=utf-8 it is unnecessary and makes the source harder to read.

For escaping text destined for a URL rather than HTML, use the URL encoder. To tidy the markup itself, use the HTML beautifier.

Related tools

All encoding / security