HTML Encode/Decode
Escape special characters to HTML entities so code and user input display safely, or decode entities back to text. Runs entirely in your browser.
The five HTML special characters
| Character | Named entity | Numeric |
|---|---|---|
| & | & | & |
| < | < | < |
| > | > | > |
| " | " | " |
| ' | ' | ' |
What HTML encoding is for
HTML gives a handful of characters structural power. A < starts a tag, an
& starts an entity, and quotes delimit attribute values. To show those
characters as literal text - a snippet of code in a tutorial, a maths expression, or anything a
user typed - you replace them with entities so the browser prints them instead of interpreting
them. Decoding does the reverse, turning entities back into the raw characters.
Encode the ampersand first
Order matters. Because every entity itself begins with an ampersand, you must escape
& to & before you touch the angle brackets - otherwise
encoding < to < and then re-encoding the ampersand would
produce a mangled &lt;. This tool always encodes in the correct order, so
Tom & Jerry <3 becomes Tom & Jerry <3 exactly
once.
Named versus numeric, and non-ASCII
For the five core characters this tool emits the widely supported named entities (plus a
numeric one for the apostrophe, whose ' name is not valid in old HTML).
Tick encode non-ASCII characters to also convert accents, symbols and emoji:
common ones such as the copyright sign and non-breaking space use their named entities, and
everything else falls back to a numeric &#NNN; reference. Leave it off for
modern UTF-8 pages, where those characters are perfectly safe as-is.
Escaping user input like this is the front line against cross-site scripting. For other developer needs, reach for the URL encoder when a value goes into a link, the Base64 encoder for binary-safe transport, or the JSON formatter to tidy API data.