About this HTML entity tool
In HTML, <, >, and & start tags and entities, and quotes end attribute values, so text that contains them must be escaped before it goes into a page. Encoding writes them as <, >, &, ", and ', which is what you need to show code examples, to put user input safely into HTML, or to keep an email template from breaking. You can also encode every non-ASCII character for systems that only accept plain ASCII. Decoding does the reverse and understands named entities such as — as well as decimal and hex codes.
How to encode or decode HTML entities
- Paste your text. Paste text, HTML, or entities, or press an example. An example only fills the box.
- Choose Encode or Decode. For encoding, choose which characters to encode and the entity style.
- Press Convert. The result appears below, with a preview of how a browser would display it.
- Copy the result. Press Copy result or Download.
Frequently asked questions
Which characters must be encoded in HTML?
Always < and &, which start tags and entities. Inside attribute values, also the quote character that surrounds the value. Encoding > and both kinds of quotes everywhere is the safe default this tool uses.
Why is the apostrophe written as ' and not '?
The named entity ' is not part of HTML 4, so some older email clients and browsers show it literally. ' works everywhere.
Is encoding enough to prevent XSS?
Encoding is the right protection for text placed between HTML tags and inside quoted attributes. Values placed in JavaScript, CSS, or URLs need their own escaping, so use your framework’s templating functions for those.
What happens to an entity it does not know?
It is left exactly as written, and the result says how many were left. Numeric entities such as 👍 always decode.
Should I encode accented letters and emoji?
Not for modern pages served as UTF-8. Encode them only for systems that cannot handle UTF-8, such as some old email or database setups.