HTML Entity Encoder & Decoder
Escape text for HTML or decode &, , ₹ and every other entity back to characters.
Text
Escapes only & < > " and ' — enough to put text safely inside HTML.
Encoded
The result appears here as you type.
How is this calculated?
& → & < → < > → > " → " ' → '
any character → &#<decimal code point>; or &#x<hex code point>;Runs in your browser — nothing you enter leaves this device.
About this tool
What it does
HTML reserves a few characters: < starts a tag, & starts an entity, and quotes end attribute values. To show them as text, or to send non-ASCII characters through systems that only accept ASCII, they’re written as character references such as <, & or ₹. This tool escapes text for safe use inside HTML, and decodes references back to characters. Decoding uses your browser’s own HTML parser, so all 2,231 named references in the HTML standard — and numeric forms in decimal or hexadecimal — decode exactly as a web page would, including legacy ones written without a semicolon.
How to use it
- Choose Encode or Decode.
- To encode, pick what to escape: only the HTML-special characters, everything outside ASCII as well, or all punctuation.
- For non-ASCII, choose decimal (₹) or hexadecimal (₹) references, and whether to use names like —.
- Paste your text. When decoding, the entities it contained are listed underneath.
- Swap to reverse the conversion, or copy the result.
Limits and your data
- Escaping text protects it inside HTML element content and quoted attributes. It is not enough on its own for URLs, CSS or JavaScript contexts — use a framework’s escaping or a sanitiser for untrusted input.
- This isn’t an HTML sanitiser: it doesn’t remove dangerous tags, it only turns characters into references and back.
- Encoding with names uses a small set of common names ( , ©, —…); other characters become numbers, which every browser reads the same way.
- Input is limited to 1 MB.
- Encoding and decoding happen in your browser. Pasted text is decoded inside a detached document as plain text, so no markup is rendered, no image loads and no script runs. Nothing is uploaded or saved.
Questions
Which characters must I escape in HTML?
In text between tags, & and < are essential, and > is escaped by convention. In attribute values also escape the quote character you used to wrap the value. The Minimal mode escapes all five.
Why is different from a space?
is a no-break space (U+00A0). It looks like a space but stops a line breaking at that point, and many string comparisons treat it differently from an ordinary space — a common cause of “identical” text not matching.
Decimal or hex references?
Both work in every browser. Hex matches how Unicode code points are usually written (U+20B9 is ₹), so it’s easier to look up; decimal is slightly more common in older content.
Why do I see &amp; in my data?
The text was escaped twice. Decode once to get &, and again to get &. Escaping should happen exactly once, when the text is written into HTML.