HTML Entity Encoder
Escape text for HTML, or decode entities back to characters.
Encode and decode
Encoding turns the five HTML-special characters โ & < > " ' โ into their entities so they display literally instead of being parsed; an option extends that to accents, symbols and emoji as numeric entities for ASCII-only systems. Decoding reverses any entity soup โ named, decimal or hex โ using the browser's own parser, which is the authoritative implementation.
Why escaping is a security habit, not just tidiness
The mundane case: showing code samples in a blog, an ampersand in a query string
(?q=fish&chips in markup), a stray < swallowing half a paragraph.
Annoying, visible, fixable.
The serious case is user input. Text inserted into a page unescaped is cross-site
scripting: a comment containing <script> becomes a script that runs for
every visitor. The rule is escape on output, every time, using your framework's mechanism โ
this tool is for the manual moments, not a substitute for one. Note the neighbouring
schemes do different jobs: percent encoding protects URLs,
Base64 carries binary through text, and our
Base64 guide draws the lines between them.
Frequently asked questions
What characters must be escaped in HTML?
&, <, >, plus " and ' inside attributes. Everything else is optional โ accents and emoji are fine literally in UTF-8 pages.
What is the entity for an ampersand?
& โ and it must come first when encoding, or you double-encode the & in every other entity.
What is the difference between © and ©?
The same character, ยฉ, as a numeric and a named entity. Named ones are readable; numeric work for every Unicode character, named only for a defined list.
Why does my page show &amp; as text?
It has been double-encoded โ the & of & was escaped again. Decode twice here to see the original, then fix the pipeline doing the second pass.