How to use it

Choose Encode to make text safe for HTML, or Decode to turn entities back into characters.
When encoding, choose whether accented letters and symbols should stay as they are or become entities.
Type or paste your text; the result updates instantly.
Copy the result, or use “Use output as input” to check that it decodes back to the original.

How it works

In HTML, a few characters have special meaning: < starts a tag, & starts an entity, and " or ' end an attribute value. To show them as text, they must be written as character references: < for <, > for >, & for &, " for " and ' for '. The apostrophe uses the numeric form because ' is not defined in HTML 4.

All other characters, including accented letters, Chinese text and emoji, can be written directly when the page is saved and served as UTF-8, which is the default for modern websites. Converting them to entities is only needed for systems that are not UTF-8 safe, such as some old email templates or databases. You can then choose named entities such as é where a common name exists (with a numeric fallback for everything else) or numeric references such as é for every character.

Decoding does not use the browser's HTML parser. It uses a built-in table with all 252 named entities from HTML 4.01, ' and about 30 common HTML5 names, plus decimal and hexadecimal references. Numeric references follow the HTML5 rules: , surrogate values and values above U+10FFFF become the replacement character �, and values 128–159 are read as Windows-1252, so  becomes an en dash. A few legacy names such as &amp and &copy are also accepted without the closing semicolon, as browsers do. HTML5 defines over 2,000 names; rare ones outside the table are left unchanged and listed.

Escaping text before inserting it into HTML is an important defence against cross-site scripting (XSS), but it is only correct for element content and quoted attribute values. Text placed inside a <script> block, a style attribute or a URL needs different escaping.

Examples

Showing code on a web page

To display <div class="box"> as text in a blog post, encode it to <div class="box">. The browser shows the original tag instead of creating an element.

Preparing text for an old email template

With “Named entities where available”, “Café – 5 €” becomes Café – 5 €, which displays correctly even if the email is sent with a non-UTF-8 character set.

Cleaning up scraped or exported text

A CMS export contains Fish & Chips – £9. Decoding gives Fish & Chips – £9, ready to paste into a spreadsheet.

Frequently asked questions

Which characters must be escaped in HTML?

In element content, & and < must be escaped (> is recommended too). Inside attribute values, also escape the quote character that surrounds the value. Escaping all five (& < > " ') everywhere is the simple, safe rule this tool follows.

What is the difference between named and numeric entities?

Named entities such as © are easier to read but only exist for a limited set of characters. Numeric references such as © (decimal) or © (hexadecimal) work for every Unicode character, including emoji.

Why does   decode to something that looks like a space?

  is a non-breaking space (U+00A0). It looks like a normal space but prevents a line break and is not collapsed by HTML. It is a different character from the ordinary space, which matters when you compare or search text.

Do I need to encode accented letters like é?

Not if your page uses UTF-8 (<meta charset="utf-8">), which almost all modern pages do. Keep the default setting and only the five special characters are escaped.

Is encoding enough to prevent XSS?

It is enough for untrusted text inserted into HTML element content or into quoted attribute values. It is not enough for JavaScript code, CSS, unquoted attributes or URLs such as href="javascript:…", which need context-specific handling.

Privacy

Encoding and decoding are done with plain string operations in your browser; your text is never rendered as HTML, uploaded, stored or included in analytics.