What next?
Entities escape markup. These escape other contexts.
How to use this tool
- Paste your text or HTML.
- Choose encode (to entities) or decode.
- Copy the result.
What your result means
The encoded output is text that a browser will display literally rather than interpret as markup. Once < becomes <, the browser draws a less-than sign on the page instead of starting a tag — which is exactly what you want when you are showing code samples, and exactly what prevents user-supplied text from injecting elements into your page.
Decoding runs the other way and should be treated with more care. Text that arrives already encoded is usually encoded for a reason; decoding it and then writing it into a page as HTML re-opens the hole the encoding closed. Decode for reading, not for re-inserting.
Why this one is different
Both directions report a round trip: after encoding, the tool decodes its own output and confirms it returns your input byte for byte. It also declines to guess — an ampersand with no closing semicolon is reported rather than quietly repaired, and input that already holds entities raises a double-encoding warning before < becomes &lt;. Every substitution is listed with a count, so you can see whether the one character you cared about was touched.
The five that matter, and the ones people ask for
| Character | Named | Numeric | When it must be encoded |
|---|---|---|---|
| & | & | & | Always — it starts every other entity |
| < | < | < | Always in body text — otherwise a tag opens |
| > | > | > | Not strictly required, encoded here for symmetry |
| " | " | " | Inside double-quoted attribute values |
| ' | ' | ' | Inside single-quoted attribute values |
| non-breaking space | |   | Never required; used to stop a line break |
| em dash | — | — | Never on a UTF-8 page — type the character |
Encoding uses ' rather than ' for the apostrophe, because the numeric form is understood by older XML and email clients that never implemented the named one. Decoding accepts all three forms — named, decimal and hexadecimal.
How to show a < without breaking the page
Some characters are special to HTML: a browser reads < as the start of a tag and & as the start of an entity. To display them literally you replace them with named entities like < and &.
Beyond looks, encoding user-supplied text is a core defence against cross-site scripting (XSS) — it stops injected markup from ever running as code.
Related tools
Why HTML entities exist
Five characters have structural meaning in HTML: <, >, &, " and '. Written literally inside content they either break the page or, worse, allow injected markup to execute. Replacing them with entity references — <, & and so on — makes the browser display the character instead of interpreting it.
Worked example
Encoding a snippet of HTML so it can be shown on a page:
Output <a href="x">Hi & bye</a>
Four characters were replaced: the angle brackets that would have started a tag, the quotes that would have ended an attribute, and the ampersand that would have started another entity. Pasted into a page, the encoded version displays the link markup as text instead of rendering a link.
Escaping is context-sensitive, which is why one pass is not enough
The same character needs different treatment depending on where it lands. In text content, the ampersand and the angle brackets must be escaped. In an attribute value, the quote character that delimits the attribute must be escaped too, or a value can close its own attribute and inject markup. Inside a script block, HTML escaping does nothing useful and JavaScript string escaping is required instead. Inside a URL, percent-encoding is the correct scheme.
This is why "escape the input once on the way in" is bad advice. The safe pattern is to store the raw value and escape it at the moment of output, using the encoding that matches the context it is being written into. A value escaped once and then rendered into two different contexts will be wrong in at least one of them.
On a modern UTF-8 page, entities for ordinary characters — accents, dashes, symbols — are unnecessary. Reserve them for the five characters that carry structural meaning, plus the non-breaking space where you genuinely need to prevent a wrap. Everything else is easier to read, search and edit as the literal character.
Frequently asked questions
Which characters actually have to be escaped?＋
In ordinary text content, & and < are mandatory. Inside a double-quoted attribute value you must also escape ". Escaping > and ' is conventional and harmless. Everything else — accents, symbols, emoji — is safe to write directly in a UTF-8 document.
Named entities or numeric ones?＋
Named references such as © are more readable; numeric references such as © work everywhere and need no lookup table. Both are valid HTML. Named references are only defined for HTML, so use numeric ones in XML.
Is entity encoding enough to prevent XSS?＋
It is necessary but not sufficient. Escaping must match the context — HTML body, attribute, URL and JavaScript each require different treatment, and a value escaped for one is not safe in another. Use your framework's contextual escaping rather than a single pass of entity encoding.
What is the difference between escaping for HTML and for attributes?＋
Text content needs the angle brackets and ampersand escaped. Attribute values additionally need the quote character that delimits them, otherwise a value can break out of the attribute and inject markup.
Do I need to escape non-ASCII characters?＋
Not if the document is served as UTF-8, which it should be. Entities for accented letters and symbols are a legacy of older encodings and only make source harder to read.
What about escaping inside JavaScript or JSON?＋
HTML entities do not apply there. A string inside a script block needs JavaScript escaping, and content placed into JSON needs JSON encoding. Applying the wrong one is a common source of both bugs and vulnerabilities.
Assumptions & limitations
Escaping is mechanical; deciding what needs escaping and in which context is not:
- Escaping for HTML text and for attribute values are different jobs. Attribute values also need the delimiting quote escaped.
- Entity encoding is not a substitute for context-aware output encoding inside script, style or URL contexts.
- On a UTF-8 page, accented characters and symbols need no entity at all. Encoding them only makes the source harder to read.
- Decoding untrusted input and then inserting it into a page reverses the protection escaping provided.