Quick answer
An HTML entity writes a character as a code that starts with & and ends with a semicolon: < is <, & is &, and é or é is é. At minimum, escape the five characters & < > " ' whenever you want them shown as text instead of being read as HTML.
What is an HTML entity?
Paste text or HTML to turn special characters into entities, or paste a string full of &, or ’ to decode it back to plain text. You can escape only the five special characters (enough in most cases) or every non-ASCII character such as accented letters and emoji, as named (é), decimal (é) or hex (é) entities. Decoding also understands old Windows-1252 style codes (–) the way browsers do. Everything runs on your device.
How to encode or decode HTML entities
- 1
Choose “Encode” or “Decode” at the top of the tool.
- 2
When encoding, pick the scope: special characters only (accented letters stay as they are) or every non-ASCII character (for ASCII-only systems and old email), then choose the entity format.
- 3
Paste your content on the left; the result appears on the right straight away. Press “Copy” to take it.
- 4
Press “Swap” to move the output into the input and run the opposite direction, a quick way to check that encoding then decoding gives back the original.
The 5 characters you must escape in HTML
| Character | Named | Numeric | Why |
|---|---|---|---|
| & | & | & | Starts every entity; left alone it can be misread (for example © in a URL) |
| < | < | < | Opens an HTML tag and can make the browser run unexpected code |
| > | > | > | Closes a tag; escape it for consistency and safety |
| " | " | " | Ends an attribute value wrapped in double quotes |
| ' | ' | ' | Ends a single-quoted attribute; ' is missing from HTML4, so ' is common |
Swipe sideways to see the whole table →
Three ways to write the same character
| Form | Example for © | Notes |
|---|---|---|
| Named | © | Readable, but only about 2,000+ characters have names in the HTML standard |
| Decimal | © | Works for any Unicode character |
| Hex | © | Same value, written as the Unicode code point U+00A9 |
Real-world examples
Showing code in a blog post
To display <div class="box"> instead of creating a real div, encode it as <div class="box"> and paste that into the HTML editor.
Product names showing “&amp;”
The data was escaped twice on its way through several systems. Decode once to get “&”, again to get “&”, then remove the extra escaping step.
Garbled characters in email
An old mailer without a UTF-8 header turns “café” into “café”. Encoding non-ASCII characters as é makes the text display correctly in any encoding.
Scraped text full of
Text copied from web pages often contains and –. Decode it to get real spaces and dashes before pasting into a spreadsheet.
Common mistakes
- Double escaping into &lt;.
- Escape in ONE place, right when inserting into HTML. If your framework (React, Blade, Twig) already escapes output, do not escape again.
- Assuming entity encoding stops XSS everywhere.
- Entities are only safe for element content and quoted attributes. Inside <script>, onclick, href="javascript:" or CSS you need different escaping, or better, no user data at all.
- Missing semicolons: © 2026.
- Browsers guess some legacy names but not reliably; always write © in full. This tool also only decodes entities that end with a semicolon.
- Encoding every accented letter bloats the HTML.
- If the page declares <meta charset="utf-8">, there is no need: choose “Special characters only”.
Do I need to encode accented or non-English letters?
No, if the page uses UTF-8 (almost every website today). Accented letters written directly in HTML display correctly, keep files smaller and are easier to edit.
Encode every non-ASCII character only when content passes through systems with an uncertain encoding: old HTML email, XML files sent to other software, or strings that must sit in ASCII-only source code.
Glossary
- Entity
- A &…; sequence standing for one character, such as & for &.
- Named reference
- An entity with a name like or ©, predefined by the HTML standard.
- Numeric reference
- An entity written as a number: é (decimal) or é (hex) for the Unicode code point.
- Escaping
- Replacing characters that have a special meaning with a safe form so they display as plain text.
- XSS
- Cross-site scripting: injecting script into a page through user input that was not escaped properly.
-
- A non-breaking space that keeps two words on the same line, as in “100 km”.
Frequently asked questions
How is different from a normal space?
Browsers never break a line at and do not collapse several of them into one like normal spaces. Do not use it for layout; use CSS.
Should I use ' or '?
Both are the apostrophe. ' exists in HTML5 and XML but not in HTML4, so ' is safer for email and old browsers; this tool uses '.
Do named and numeric entities display differently?
No. ©, © and © all render as ©. Names are easier to read; numbers work for every character, including emoji.
Which PHP function escapes HTML?
htmlspecialchars($s, ENT_QUOTES, 'UTF-8') escapes the five special characters, like the “Special characters only” mode; htmlentities also escapes every character that has a name. Use html_entity_decode to decode.
Does JavaScript have a built-in HTML escape function?
There is no standard one. Assigning the string to an element's textContent (instead of innerHTML) is the safest approach, and React and Vue escape variables automatically.
Why is an entity left undecoded?
The tool knows the commonly used names (Latin-1, Latin letters with names, maths symbols, arrows, Greek). Rare names are kept as they are and listed in the status line; numeric entities are always decoded.
Ratings and comments
Loading…