Escape and unescape HTML entities online — free, fast, private.
What are HTML entities?
HTML entities are escape sequences that let you write characters which would otherwise be
interpreted as markup or are hard to type on a keyboard. Every entity starts with an ampersand
and ends with a semicolon. When a browser renders the page, it replaces each entity with the
real character, so reserved symbols can appear as literal text inside tags and attributes.
Entities come in three forms: named entities use a memorable word, while numeric entities use
the character's Unicode code point in decimal or hexadecimal form. Numeric entities can represent
any character, even ones that have no name, such as emoji and rare symbols.
How to use this tool
- Paste or type your text into the input box above.
- Choose an encode mode: basic escapes only &, <, >, quotes and
apostrophes; all non-ASCII also converts every accented letter, symbol and
emoji into a hexadecimal numeric entity.
- Click Encode or Decode — or enable live mode
to convert automatically as you type.
- Copy the result with one click.
Common HTML entities
& — ampersand (&)< — less-than sign (<)> — greater-than sign (>)" — double quotation mark (") — non-breaking space© — copyright sign (©)
Common mistakes when escaping HTML
- Double-encoding. Encoding text that is already encoded turns
& into &amp;, so the page then shows & instead of a single ampersand. Fix: click Decode first, then encode the plain result once.
- Encoding a whole HTML file. Encoding escapes every tag, so a working
<p> becomes the visible text <p>. Only encode the snippet you want shown as a code sample, never markup you still want rendered.
- Missing semicolons. An entity is only valid with its trailing semicolon:
& decodes, while & stays literal. When decoding, make sure every entity in your input ends with a semicolon.
Pro tips
Switch to Encode all non-ASCII when the result must survive ASCII-only channels such as old email templates or legacy source files: e-acute becomes é and even an emoji becomes something like 😀. The decoder accepts named, decimal (©) and hexadecimal (©) forms in a single pass, and it leaves any entity it does not recognize untouched, so partially encoded or mixed text is safe to run through.
Frequently asked questions
What are HTML entities?
HTML entities are short escape sequences that stand in for characters that are reserved in markup or hard to type. They start with an ampersand and end with a semicolon, and the browser replaces them with the real character when rendering the page, so markup characters can be shown as literal text.
What is the difference between named and numeric entities?
Named entities use a memorable word, such as the entity for an ampersand or a copyright sign, but names exist only for a limited set of characters. Numeric entities use the character's Unicode code point in decimal or hexadecimal form, so they can represent any character, including emoji and rare symbols.
How does escaping HTML entities prevent XSS?
Cross-site scripting happens when user-supplied text is inserted into a page as raw HTML, letting an attacker inject script tags or event handlers. Escaping the angle brackets, quotes and ampersands in that text turns the markup into inert display characters, so the browser shows it as text instead of executing it.
Which characters must always be escaped in HTML?
At minimum, always escape the ampersand and the less-than sign in text content, because they introduce entities and tags. Inside attribute values, also escape the quotation mark that delimits the attribute. Escaping the greater-than sign and apostrophes is recommended for consistency and safety.