HTML Entity Encoder & Decoder
Escape HTML special characters, or decode entities back to text.
Characters to escape
| Character | Entity | Why |
|---|---|---|
& |
& |
Starts an entity |
< |
< |
Starts a tag |
> |
> |
Closes a tag |
" |
" |
Ends a double-quoted attribute |
' |
' |
Ends a single-quoted attribute |
Named entities like © are easier to read. Numeric ones like © or © work for any character.
Escaping characters above ASCII
Escape non-ASCII too turns every character above U+007F into a numeric entity. With <meta charset="utf-8"> you don’t need it, and plain UTF-8 is smaller. It is still useful for email templates and old systems that break non-ASCII bytes.
Questions
Which characters must be escaped in HTML?
In text, & and < must be escaped. Inside an attribute, so must the quote around it. Escaping all five of & < > " and ' is the safe default, and it's what this tool does.
Why is the apostrophe encoded as ' instead of '?
' isn't part of HTML4, so some older parsers don't know it. ' works everywhere.
Does escaping HTML prevent XSS?
It helps, but it isn't enough on its own. Text, attributes, URLs, CSS and JavaScript each need different escaping. Let your framework's templates handle it.
What is and why does it keep appearing?
A non-breaking space: it looks like a space but stops a line break there. Word processors add them often, so pasted text is full of them. Decoding turns them into normal spaces.
Why escape & first when doing it by hand?
If you escape < first, you create <, and escaping & afterwards turns it into &lt;. Escape & first, then the rest.