HTML Entity Encoder / Decoder

Characters like &, < and > mean something to a browser, so to show them as text you write them as entities: &amp;, &lt;, &gt;. This tool encodes plain text into entities and decodes entities back into readable characters, including named ones like &copy;, decimal ones like &#169; and hex ones like &#xA9;. It can also turn every non-English character into a numeric code for systems that only accept ASCII.

How to use it

1. Paste your text or HTML.
2. Choose encode or decode.
3. When encoding, tick the option for non-English characters if you need pure ASCII.
4. Copy the result.

When it helps

• Showing a snippet of HTML as text on a web page.
• Escaping user input before it goes into markup.
• Reading page source that's full of entities.
• Preparing text for an older system that only takes ASCII.

Good to know

• If a page shows a literal &amp; where you wanted &, the text was encoded twice. Decode it once.
• Unknown entity names are left alone when decoding rather than guessed at.
• Encoding by hand isn't a substitute for your framework's own output escaping.

Why entities exist

HTML uses angle brackets and ampersands as syntax, so those characters can't appear literally in content without being misread. Writing them as entities, such as &lt; for the less-than sign, tells the browser to display the character instead of treating it as markup. Quotes need the same treatment inside attribute values.

Entities also let you include characters your keyboard or file encoding can't produce, using a number: &#8364; is the euro sign, and &#x1F600; is a grinning face.

Worked example: showing code on a page

Say you want to show the tag <a href="/shop?a=1&b=2"> in a tutorial. Paste it and choose Encode. The result replaces each angle bracket, quote and ampersand, and you can paste that into your page so readers see the tag as text rather than a link.

Going the other way, paste text full of entities from a page source and choose Decode to read it normally.

Security: encoding is not optional

Failing to escape user-supplied text is the cause of cross-site scripting, one of the most common web vulnerabilities. If a comment containing a script tag is placed into a page unescaped, the script runs in other visitors' browsers.

Use your framework's built-in escaping for output rather than doing it by hand, and use this tool to inspect and understand the results.

Common entities at a glance

The ones you will meet most are &amp; for the ampersand, &lt; and &gt; for angle brackets, &quot; for a double quote, &#39; for an apostrophe, &nbsp; for a non-breaking space, &copy; for the copyright sign, and &euro; for the euro. Numeric forms work for anything, even when a name doesn't exist.

Questions