Encode and decode HTML entities

Entities in, entities out.

Encode special characters to named, decimal, or hex entities. Decode any HTML5 named entity, plus decimal (&#xNN;) and hex (&#NN;) references. Pure browser; no login.

Encoded

HTML entities: when and how to escape characters

In HTML, a few characters have special meaning. A < starts a tag and an & starts an entity, so showing them as text requires writing them as entities: &lt; for <, &amp; for &. Entities can also write any Unicode character in plain ASCII, such as &eacute; for é or &#169; for ©.

This tool encodes text into named, decimal or hexadecimal entities, and decodes any entity back into the character it stands for. Use it to put code samples into web pages, to fix text that shows &amp;amp; and similar mistakes, or to read the source of an email template.

How to use it

  1. Type or paste the text to encode, or the HTML with entities to decode.
  2. Choose the encoding style: named (&eacute;), decimal (&#233;) or hex (&#xE9;).
  3. Switch to decoding to turn entities back into characters.
  4. Copy the result. Decoded output is shown as text and is never rendered as HTML.

Example: one word, three styles

Input
café
Output
Named: caf&eacute;
Decimal: caf&#233;
Hex: caf&#xE9;

All three mean the same character, é, code point 233 or E9 in hex. Named entities are easiest to read, numeric ones work for every character.

Which characters must be escaped

In text content, < and & must be escaped, and > usually is for symmetry. Inside an attribute value, the quote character that wraps the value must be escaped too: " as &quot; or ' as &#39;. Everything else, including accented letters and emoji, can be written directly as long as the page is served as UTF-8, which nearly all are today.

Escaping is also a security measure. When user input is inserted into a page without escaping, an attacker can inject a <script> tag, a vulnerability called cross-site scripting (XSS). Templating systems such as React, Vue and Jinja escape automatically; this tool is for the cases where you write HTML by hand.

Named or numeric?

HTML5 defines more than 2,000 named entities, from &nbsp; to &hearts;, but not every character has a name, and very old email clients only know a small set. Numeric entities work for any Unicode character: the decimal form uses the code point in base 10, the hex form in base 16. If in doubt, use numeric entities for anything beyond the basic five: &amp;, &lt;, &gt;, &quot; and &#39;.

Fixing double-escaped text

If a page shows &amp;amp; or &amp;quot;, the text was escaped twice, often by two systems that both thought they were responsible. Decode once and check the result. If it still shows entities, decode again; then make sure only one layer escapes in the future.

Questions

Is &nbsp; the same as a space?

No. It is a non-breaking space: it looks like a space but stops a line break at that point, for example between a number and its unit.

Do I need entities for emoji?

Not in a UTF-8 page. Write the emoji directly. Entities like &#x1F600; are only needed where the file encoding cannot hold the character.

Is anything uploaded?

No. Encoding and decoding run in your browser.