HTML Entity Encode / Decode

About HTML entity encoding

What is HTML entity encoding?

HTML entity encoding replaces characters that have special meaning in HTML — like < > & " ' — with escape sequences called character references, so they render as literal text instead of being interpreted as markup.

Why do these five characters need escaping?

< and > delimit tags, & starts a character reference, and " and ' delimit attribute values. Inserting untrusted text into HTML without escaping these can let it break out of its context and inject markup or scripts — a classic XSS vector.

What's the difference between named and numeric character references?

Named references like &amp; are readable but only cover a fixed (if large) table of known names. Numeric references like &#233; or &#xE9; can represent any Unicode code point, and are what this tool falls back to for non-ASCII text when "Encode all non-ASCII" is on.

Decimal vs hex numeric entities — does it matter which?

No — &#233; and &#xE9; are the decimal and hexadecimal form of the exact same character (é) and browsers treat them identically. Which one to use is a stylistic or legacy-compatibility choice, not a correctness one.

Does this tool upload my data anywhere?

No. Encoding and decoding happen entirely in your browser using standard Web APIs. Nothing you type or paste ever leaves your device.

Configuration options

Encode all non-ASCII

Also converts characters outside the reserved set — accented letters, emoji, CJK, etc. — into numeric character references. Useful for guaranteeing ASCII-only output that is safe regardless of the document's declared encoding; leave off to only escape the five characters that are unsafe in HTML (& < > " ').

Hex numeric entities

When non-ASCII characters are being encoded, writes them as &#xHEX; instead of the default &#DECIMAL; form. Purely cosmetic — browsers treat both identically.