Tom & Jerry — “café” © 2024 😀
About HTML Entities — Encode & Decode / Escape Online
HTML entities are the escape sequences that let you show reserved characters — like <, >, &, and quotes — as literal text instead of having the browser treat them as markup. Writing <script> renders the words "<script>" on the page rather than opening a real tag, which is why entity encoding is essential whenever you drop code samples, user input, or special symbols into HTML.
This free HTML entity encoder and decoder works in both directions: escape plain text into safe entity form, or unescape entity sequences back to readable characters. It understands named references (©), numeric decimal (©), and hexadecimal (©), and you can choose named or numeric output for encoding.
Everything runs entirely in your browser — nothing you paste is uploaded — so it's safe for snippets, templates, and sensitive content alike.
Features
- Encode text to HTML entities and decode entities back to text
- Choose named (©) or numeric (©) output for encoding
- Decodes named, decimal (&#NN;), and hex (&#xNN;) references
- Always escapes the markup characters & < > " '; works fully offline
How to use
- Paste an HTML fragment to decode, or plain text to encode, into the input pane.
- Pick Decode to unescape entities, or Encode to escape your text.
- For Encode, toggle Named or Numeric to control the entity style.
- Copy the result from the output pane, or clear and start again.
Frequently asked questions
What is the difference between named and numeric entities?
Named entities use a memorable keyword, like © for ©, while numeric entities reference the Unicode code point in decimal (©) or hex (©). Both render identically; named ones are easier to read, numeric ones work even when a name does not exist.
Which characters must be escaped in HTML?
At minimum, & must become &, < becomes <, and > becomes >. Inside attribute values you should also escape " (") and ' ('). This tool always escapes those five so your output is safe in both element and attribute contexts.
Is HTML entity encoding the same as escaping for security?
Entity encoding is the core of preventing HTML/XSS injection, because it stops user input from being parsed as markup. It is a display-safety measure, not encryption — anyone can decode it. Always encode untrusted content before placing it in a page.
Does my text get sent to a server?
No. All encoding and decoding happens locally in your browser with a hand-rolled entity table — no network requests, no third-party libraries calling home. Your input never leaves your device.
Related tools
Everything runs locally in your browser — your input is never uploaded.