HTML Entity Encoder & Decoder – Escape & Unescape Special Characters
Convert plain text to safe HTML entities, or decode named, decimal, and hex entities back to readable characters. Choose from three encoding scopes, named or numeric output, and inspect a character-by-character analysis. Free, private, and runs entirely in your browser.
Input & Settings
Encode mode · Safe minimumOutput
Encoded HTML entities| Char | Code point | Entity | Count |
|---|
Common HTML entities reference
Click any row to load that character into the input. Use the search box to filter by character, name, or description.
| Char | Named | Decimal | Hex | Description |
|---|
What is HTML entity encoding?
HTML uses certain characters as syntax: < opens a tag, > closes it, & starts an entity, and quotes delimit attribute values. If you want to display the literal text <div> on a web page without the browser parsing it as a tag, you must encode it as <div>. That's what HTML entity encoding does.
Entity encoding matters for two reasons. First, it makes special characters display correctly. Second, and more importantly, it prevents cross-site scripting (XSS) vulnerabilities when you insert user-generated or third-party content into an HTML template. If you skip encoding, a malicious string like <script>alert(1)</script> would execute as code instead of appearing as text.
This tool gives you three encoding scopes so you can match the output to your exact use case, plus a decoder that handles named, decimal, and hexadecimal entities in one pass.
Encoding scopes explained
| Scope | What it encodes | Best for |
|---|---|---|
| Safe minimum | Only &, <, >, ", and ' | Escaping user input before inserting it into an HTML template. Produces the most readable output. |
| Full non-ASCII | The five safe-minimum characters plus every non-ASCII character (accented letters, symbols, emoji) | When your output must be strict ASCII for maximum compatibility across legacy systems and email clients. |
| Numeric all | Every single character, including plain letters and digits | Obfuscation, parser testing, and certain email compatibility requirements. |
The entity format option controls how each encoded character is represented. Named entities like © are human-readable. Decimal entities like © work for any character. Hex entities like © are compact and commonly used in CSS and JavaScript contexts.
Named vs numeric entities
Named entities are shorthands defined by the HTML standard. There are roughly 2,000 of them, covering everything from & to 𝔄. They're easier to read and remember, which makes them a good choice for hand-written HTML.
Numeric entities reference the character's Unicode code point directly. Decimal uses base 10 (©), hex uses base 16 (©). Numeric entities work for any Unicode character, including those without a named entity — CJK characters, rare symbols, and emoji. If you're encoding content that might contain arbitrary Unicode, numeric entities are the safer choice.
This tool prefers named entities when a character has one, and falls back to decimal or hex when it doesn't. That gives you readable output for common characters and universal coverage for everything else.
Why decode HTML entities?
Decoding is the reverse operation: it turns entity references back into the characters they represent. You'll need it when you're debugging encoded output, cleaning up data that's been double-encoded, or extracting readable text from HTML source.
The decoder in this tool handles all three entity formats — named, decimal, and hex — in a single pass. It also tolerates missing semicolons for common cases, which is useful when you're dealing with hand-written or legacy HTML that doesn't always follow the spec strictly.
Frequently asked questions
<, >, &, and quotes — with safe entity references such as <, >, and &. This prevents the browser from interpreting your text as markup, which is essential for displaying code, user input, and special characters safely.© or , while numeric entities reference the character's Unicode code point directly, either in decimal (©) or hexadecimal (©). Named entities are more readable; numeric entities work for any character, including those without a named entity.&, <, >, double quote, and single quote. This is the correct mode for escaping user input before inserting it into an HTML template.&, decimal entities like &, and hexadecimal entities like &, with or without a trailing semicolon for common cases.