HTML Entities Encode / Decode
Escape text for HTML or decode &-style entities back to characters
About this tool
Escape text for safe inclusion in HTML — & becomes &amp;, < becomes &lt; — or decode entity-laden text back to readable characters, covering named entities (&rarr;), decimal (&#169;) and hexadecimal (&#xA9;) numeric references.
Encoding offers two levels: the five essential characters that break HTML structure (& < > " '), which is all you need for correctness, or everything non-ASCII, useful when a toolchain mangles UTF-8 somewhere between you and the page. A numeric-only mode skips named entities for maximum compatibility with strict XML parsers, which only guarantee the five predefined ones.
The decoder is the everyday half: paste a scraped snippet or an API response full of &#x27; and get clean text. Unknown entity names pass through untouched rather than being guessed.
Frequently asked questions
- Which characters must be escaped in HTML?
- In text content: & and <. In attribute values: also the quote character delimiting the attribute (" or '). Escaping > is conventional but not strictly required. Everything else can appear literally in a UTF-8 document.
- Is entity-encoding a defense against XSS?
- Escaping the five structural characters is the core of HTML-context output encoding, yes — but only for HTML text and attribute contexts. URLs, JavaScript strings and CSS need their own context-specific encodings; entity-escaping alone does not make arbitrary injection safe there.
- Named or numeric entities — which should I emit?
- Numeric references (&#xE9;) work in every HTML and XML parser. Named entities are more readable but XML only predefines five, so &eacute; breaks a strict XML/XHTML pipeline. When in doubt, numeric.
- Why do I see &amp;#39; (double-encoded) in my data?
- Two layers each encoded once: the & of the first encoding was itself escaped by a second pass. Decode twice here to recover the text, then find and fix the layer that should not be encoding.