HTML Entities Encoder / Decoder

Choose an escape for the context, not the character alone

The less-than sign can be ordinary text, the beginning of a tag, part of an attribute value, or a character inside JavaScript. HTML character references let source represent characters without giving them their usual markup role. This free online HTML entities encoder and decoder converts between raw text and named or numeric references, with live output and controls over how much text to encode.

Use Encode to protect the five common syntax-sensitive characters, extend encoding to non-ASCII characters, or represent every UTF-16 code unit numerically. Choose named, decimal, or hexadecimal output. Use Decode to resolve character references through the browser. The separate Swap Input & Mode action moves current output into input and switches direction, making round-trip checks quick.

“Entity” is common developer shorthand, though the HTML Living Standard usually discusses named character references and numeric character references. XML’s declared entities are a related but different mechanism. This page targets text interpreted as HTML.

The three encoding scopes

Special Characters Only

The default scope encodes exactly &, <, >, ", and '. For example:

Tom & Ana wrote <strong>"ready"</strong>.

Using named format produces:

Tom & Ana wrote <strong>"ready"</strong>.

This scope is appropriate when displaying markup as text or preparing a simple HTML text fragment. Context still matters: quoted attributes, unquoted attributes, URLs, CSS, and JavaScript each have additional rules. Entity encoding is not a universal injection defense.

Non-ASCII & Special Characters

This scope encodes the five special characters plus every code unit whose value is greater than 127. ASCII letters, numbers, spaces, and ordinary punctuation remain readable. It can be useful for examining how a legacy channel represents accented letters and symbols, although modern UTF-8 HTML normally supports those characters directly.

All Characters

Every input code unit becomes a reference except where named output has an explicit map entry. A short word can become a long sequence such as Hi. This is mainly diagnostic or useful for constrained systems; it increases source size and makes maintenance difficult. It is not encryption or obfuscation security.

Named, decimal, and hexadecimal forms

Named output uses a built-in map for the five special characters and a selected group of Latin-1 symbols and typographic characters, including currency signs, fractions, copyright, trademark, and several accented ligatures. When a character has no entry in that map, named mode falls back to a decimal numeric reference.

Decimal mode emits the code unit in base ten:

<>©

Hexadecimal mode emits uppercase base-16 digits with a lowercase x marker:

<>©

All generated references include a semicolon. Decimal and hexadecimal references are understood by HTML parsers when the code point is allowed and interpreted according to HTML’s numeric-reference rules.

Unicode: the important implementation boundary

The encoder loops over JavaScript string indices and calls charCodeAt. That means it works with UTF-16 code units, not full Unicode scalar values. Characters in the Basic Multilingual Plane use one unit and encode as expected. Supplementary characters, including many emoji, use a surrogate pair and are emitted as two references.

For example, encoding an emoji numerically may produce references for the high and low surrogate halves rather than one reference such as 😀. Those surrogate numeric references are not a proper scalar-value representation and may decode to replacement characters under HTML parsing. Accented Latin text and symbols within the Basic Multilingual Plane do not have that surrogate-pair issue.

This limit is particularly important with Non-ASCII or All Characters. If supplementary Unicode must survive, use a code-point-aware encoder that iterates with for...of or codePointAt, then verify the receiving format.

Decode with the browser’s HTML rules

In Decode mode, the client creates a temporary <textarea>, assigns input to its innerHTML, and reads back its value. This delegates recognition of named and numeric character references to the browser’s HTML parser. It can resolve far more named references than the encoder’s small named map can generate.

Try:

Price: €20 — save £5 & collect.

The output is raw text with the resolved euro sign, em dash, pound sign, and ampersand. Because the result is read from a textarea value, decoded <b> appears as literal characters in the output field; the page does not render it as a bold element.

During server-side rendering, the component includes a limited fallback covering the common five names, ', and decimal or hexadecimal numeric patterns. Interactive browser use follows the broader textarea behavior.

A reliable snippet-preparation routine

1. Identify where the output will be inserted: an HTML text node, a quoted attribute, source code display, XML, JavaScript, or a URL.
2. Paste raw text into the left pane and retain the default special-character scope for ordinary HTML text.
3. Select named output for readability or numeric output when a receiving convention requires it.
4. Use non-ASCII encoding only when the transport cannot reliably preserve Unicode.
5. Inspect emoji and other supplementary characters for surrogate-pair output.
6. Click Copy to place the generated string on the clipboard.
7. Use Swap Input & Mode and confirm that decoding returns the intended text.
8. Test the final insertion in its actual parser context; do not concatenate untrusted text into markup or scripts.

Clear empties input and, through live conversion, output. Directly selecting Encode or Decode changes direction without moving the previous output. The swap button is the action that both changes mode and sets input to the current result.

Escaping is not sanitization

Encoding < and > can safely display a tag-shaped string in an HTML text node, but application security requires context-aware output encoding. In a double-quoted attribute, quotes matter. In a URL attribute, scheme validation matters. In JavaScript, CSS, or JSON, HTML references are not the native escaping mechanism. If decoded data is later assigned to innerHTML, markup can become active again.

Sanitization is another operation: it parses markup and allows or removes elements, attributes, and URLs according to policy. This utility does not sanitize. It also does not validate that an input reference is semantically safe; Decode intentionally turns references back into characters.

Character references versus UTF-8

There is usually no need to encode every accented letter or currency symbol in a modern HTML document declared and served as UTF-8. Literal Unicode is shorter and easier to edit. Named references remain useful for syntax-sensitive characters, nonbreaking spaces when intentional, and a few symbols where source clarity improves. Numeric references are useful when a name is unavailable or a protocol specifies them.

Character references do not change the eventual character in the DOM. ©, ©, ©, and © represent the same character after HTML parsing. The source spellings differ; rendering semantics generally do not.

Common failures in practice

• Encoding an already encoded ampersand changes & into &, requiring another decode to return to &.
• Decoding before inserting untrusted content into innerHTML can reactivate markup.
• Using All Characters on emoji can expose the UTF-16 surrogate limitation.
• Assuming the named encoder covers every HTML named character reference leads to numeric fallback.
• Applying HTML encoding to JavaScript or URL contexts gives incomplete protection.
• Using   for visual layout confuses content semantics and wrapping behavior.

Entity tool FAQ

Which characters does the default scope encode?

Exactly ampersand, less-than, greater-than, double quote, and apostrophe.

Does named mode always emit a name?

No. It uses a finite built-in map. When the selected character has no mapped name, output falls back to a decimal numeric reference.

Can the decoder handle hexadecimal references with uppercase X?

In the browser, decoding is delegated to HTML parsing. The server fallback also explicitly accepts lowercase or uppercase x in numeric references.

Why does an emoji become two entities?

The encoder iterates UTF-16 code units. Many emoji occupy a surrogate pair, and each half is encoded separately rather than as one Unicode code point.

Is ' valid in HTML?

Modern HTML recognizes '. The encoder’s named map uses it for apostrophes; numeric ' is another common spelling.

Does Swap merely exchange the two panes?

It takes current output, places it in input, and flips Encode to Decode or Decode to Encode. New output is then computed from that input.

Are decoded tags rendered?

No. Output is displayed in a read-only textarea. Tag characters remain visible text there.

Does this protect against cross-site scripting?

Not by itself. Correct defense requires context-aware encoding, safe DOM APIs, sanitization where HTML is allowed, and appropriate application security controls.