DEVELOPER TOOLS
HTML Entity Encoder & Decoder
Turn the five special HTML characters into character references, or decode named and numeric entities back into text. Everything runs in this page; input is not uploaded, saved, or transmitted.
Encoding replaces only &, <, >, " and ' and leaves other Unicode characters alone.
Enter text to encode.
How this encoder and decoder behaves
Encoding style. Encoding replaces five characters and nothing else: & becomes &, < becomes <, > becomes >, " becomes ", and ' becomes '. The apostrophe uses a numeric reference because ' is not recognised by older HTML parsers. All other characters, including accented letters, non-Latin scripts, and emoji, are preserved as plain Unicode.
Encoding is a literal transformation. The tool does not detect existing entities, so encoding the text & produces &amp;. Decode the result if you need to normalise it. This deliberate choice avoids silently changing text that merely looks entity-encoded.
Decoding rules. Decoding supports a documented subset of common named entities such as &, ©, €, —, α, and ♥, plus decimal references like © and hexadecimal references like 😀. Named references are case-sensitive and must end with a semicolon. Unknown names, missing semicolons, and malformed numeric references are left unchanged and reported instead of being guessed at. This is not the complete HTML5 entity table.
Unicode and invalid code points. Valid numeric references are converted to the matching Unicode code point, including code points above U+FFFF such as emoji. Numeric references to null, surrogate halves, or values above U+10FFFF are replaced with the Unicode replacement character (U+FFFD), which matches how browsers parse out-of-range references.
When entities are useful. Character references let you show markup as text, include a literal angle bracket or ampersand inside HTML content, and place quotes inside attribute values without ending the attribute early.
Escaping depends on context. HTML entity encoding is not a universal sanitiser. The correct escaping differs for HTML text, attribute values, JavaScript strings, CSS, and URLs, and encoding alone does not make untrusted input safe. In particular, never insert untrusted content into script blocks or event-handler attributes. This tool performs a plain text transformation and never writes the output into the page as markup.