HTML Entity Encoder / Decoder
Escape text for HTML with named or numeric character references, and turn references such as &, é and é back into characters.
Your lid
Pin tools here. They are saved in this browser.
Pin a tool and its sticker lands here.
About this tool
What an HTML entity is
An HTML character reference, usually called an entity, writes one character using only plain ASCII. It comes in three forms: a name, as in é; a decimal code point, as in é; and a hexadecimal code point, as in é. All three produce the same é.
Five characters matter most. & and < are escaped in text, because they can start a reference and a tag. The quote character that delimits an attribute value must be escaped inside it. > is escaped by convention. Reserved only encodes exactly these five: & < > " '.
Names, numbers and where they work
HTML 4 defined 252 names, and the current HTML standard defines 2,125. XML itself predefines only five: amp, lt, gt, quot and apos. Any other name works in an XML document, such as an SVG file or an RSS feed, only if a DTD declares it. Numeric references work in HTML and XML alike, so choose numeric output when the text may end up in XML.
This tool writes the apostrophe as a numeric reference, ' or ', because ' is not part of HTML 4. A page served as UTF-8 does not need its accented letters or emoji encoded at all; All non-ASCII is for the cases where the text must survive a channel that only carries ASCII.
One group of characters cannot be written as a reference. HTML reads a numeric reference from 128 to 159 as the Windows-1252 character at that position where there is one, so … is an ellipsis and not the control character U+0085. The encoder leaves those control characters as they are and tells you when it did.
How decoding works here
The decoder applies the rules the HTML standard gives for text. Numeric references are accepted with or without the closing semicolon. A number from 128 to 159 is read as the Windows-1252 character at that position, where that encoding has one (so – is an en dash), and zero, surrogates and numbers beyond U+10FFFF become U+FFFD and are listed below the result. Names need their semicolon, except the 106 older names such as © and   that browsers still accept without it.
Names are case-sensitive and are looked up in a built-in copy of the standard's table. Something that looks like a reference but matches no name is left as it is and listed below the result. Inside an attribute value the standard leaves some references without a semicolon undecoded; this tool always applies the rules for text. Your input is never handed to the browser's HTML parser, so nothing you paste is rendered or executed.
Questions
Which characters do I have to escape in HTML?
In text, the less-than sign, and the ampersand wherever it could be read as the start of a character reference. Escaping every ampersand is the simple way to meet that rule. Inside an attribute value, also escape the quote character that surrounds the value. Escaping the greater-than sign is not required, but it is common and harmless.
Is escaping HTML entities enough to prevent cross-site scripting?
Only where the value is placed in HTML text or in a quoted attribute. A value placed inside a script block, a URL, a style or an event handler needs the escaping rules of that context instead.
What is the difference between a no-break space (nbsp) and a normal space?
The no-break space is the character U+00A0, and nbsp is its name as a character reference. A browser does not break a line at it and does not collapse several of them into one, as it does with a run of normal spaces.
Why was a reference not decoded?
A name that the HTML standard does not define is not a character reference, so a browser shows it as written, and this tool leaves it unchanged and lists it. Check the spelling and the capitalisation, because names are case-sensitive: Eacute and eacute are different characters. Also check the semicolon, which only 106 older names can do without.