HTML Entity Encoder / Decoder — Escape and Unescape HTML

Escape text for HTML with named or numeric entities, decode &-style references back to characters, and search an entity reference table.

EncodeAs

Text or HTML to encode

Encoded

&lt;p class=&quot;note&quot;&gt;Fish &amp; chips — £4.50 at Café &quot;Ōshima&quot; 🐟&lt;/p&gt;

HTML entity reference

Search by name, character, code or group

Char	Named	Decimal	Hex
"	"	"	"
&	&	&	&
'	'	'	'
<	<	<	<
>	>	>	>
·
¡	¡	¡	¡
¢	¢	¢	¢
£	£	£	£
¤	¤	¤	¤
¥	¥	¥	¥
¦	¦	¦	¦
§	§	§	§
¨	¨	¨	¨
©	©	©	©
ª	ª	ª	ª
«	«	«	«
¬	¬	¬	¬
·
®	®	®	®
¯	¯	¯	¯
°	°	°	°
±	±	±	±
²	²	²	²
³	³	³	³
´	´	´	´
µ	µ	µ	µ
¶	¶	¶	¶
·	·	·	·
¸	¸	¸	¸
¹	¹	¹	¹
º	º	º	º
»	»	»	»
¼	¼	¼	¼
½	½	½	½
¾	¾	¾	¾
¿	¿	¿	¿
À	À	À	À
Á	Á	Á	Á
Â	Â	Â	Â
Ã	Ã	Ã	Ã
Ä	Ä	Ä	Ä
Å	Å	Å	Å
Æ	Æ	Æ	Æ
Ç	Ç	Ç	Ç
È	È	È	È
É	É	É	É
Ê	Ê	Ê	Ê
Ë	Ë	Ë	Ë
Ì	Ì	Ì	Ì
Í	Í	Í	Í
Î	Î	Î	Î
Ï	Ï	Ï	Ï
Ð	Ð	Ð	Ð
Ñ	Ñ	Ñ	Ñ
Ò	Ò	Ò	Ò
Ó	Ó	Ó	Ó
Ô	Ô	Ô	Ô
Õ	Õ	Õ	Õ
Ö	Ö	Ö	Ö
×	×	×	×
Ø	Ø	Ø	Ø
Ù	Ù	Ù	Ù
Ú	Ú	Ú	Ú
Û	Û	Û	Û
Ü	Ü	Ü	Ü
Ý	Ý	Ý	Ý
Þ	Þ	Þ	Þ
ß	ß	ß	ß
à	à	à	à
á	á	á	á
â	â	â	â
ã	ã	ã	ã
ä	ä	ä	ä
å	å	å	å
æ	æ	æ	æ
ç	ç	ç	ç
è	è	è	è
é	é	é	é
ê	ê	ê	ê
ë	ë	ë	ë
ì	ì	ì	ì
í	í	í	í
î	î	î	î
ï	ï	ï	ï
ð	ð	ð	ð
ñ	ñ	ñ	ñ
ò	ò	ò	ò
ó	ó	ó	ó
ô	ô	ô	ô
õ	õ	õ	õ
ö	ö	ö	ö
÷	÷	÷	÷
ø	ø	ø	ø
ù	ù	ù	ù
ú	ú	ú	ú
û	û	û	û
ü	ü	ü	ü
ý	ý	ý	ý
þ	þ	þ	þ
ÿ	ÿ	ÿ	ÿ
Α	Α	Α	Α
Β	Β	Β	Β
Γ	Γ	Γ	Γ
Δ	Δ	Δ	Δ
Ε	Ε	Ε	Ε
Ζ	Ζ	Ζ	Ζ
Η	Η	Η	Η
Θ	Θ	Θ	Θ
Ι	Ι	Ι	Ι
Κ	Κ	Κ	Κ
Λ	Λ	Λ	Λ
Μ	Μ	Μ	Μ
Ν	Ν	Ν	Ν
Ξ	Ξ	Ξ	Ξ
Ο	Ο	Ο	Ο
Π	Π	Π	Π
Ρ	Ρ	Ρ	Ρ
Σ	Σ	Σ	Σ
Τ	Τ	Τ	Τ
Υ	Υ	Υ	Υ
Φ	Φ	Φ	Φ
Χ	Χ	Χ	Χ
Ψ	Ψ	Ψ	Ψ
Ω	Ω	Ω	Ω
α	α	α	α
β	β	β	β
γ	γ	γ	γ
δ	δ	δ	δ
ε	ε	ε	ε
ζ	ζ	ζ	ζ
η	η	η	η
θ	θ	θ	θ
ι	ι	ι	ι
κ	κ	κ	κ
λ	λ	λ	λ
μ	μ	μ	μ
ν	ν	ν	ν
ξ	ξ	ξ	ξ
ο	ο	ο	ο
π	π	π	π
ρ	ρ	ρ	ρ
ς	&sigmaf;	ς	ς
σ	σ	σ	σ
τ	τ	τ	τ
υ	υ	υ	υ
φ	φ	φ	φ
χ	χ	χ	χ
ψ	ψ	ψ	ψ
ω	ω	ω	ω
Œ	&OElig;	Œ	Œ
œ	&oelig;	œ	œ
Š	&Scaron;	Š	Š
š	&scaron;	š	š
Ÿ	&Yuml;	Ÿ	Ÿ
ƒ	&fnof;	ƒ	ƒ
ˆ	&circ;	ˆ	ˆ
˜	&tilde;	˜	˜
ϑ	&thetasym;	ϑ	ϑ
ϒ	&upsih;	ϒ	ϒ
ϖ	ϖ	ϖ	ϖ
·	&ensp;
·	&emsp;
·
·	&zwnj;	‌	‌
·	&zwj;	‍	‍
·	&lrm;	‎	‎
·	&rlm;	‏	‏
–	–	–	–
—	—	—	—
‘	‘	‘	‘
’	’	’	’
‚	&sbquo;	‚	‚
“	“	“	“
”	”	”	”
„	&bdquo;	„	„
†	&dagger;	†	†
‡	&Dagger;	‡	‡
•	•	•	•
…	…	…	…
‰	&permil;	‰	‰
′	′	′	′
″	″	″	″
‹	&lsaquo;	‹	‹
›	&rsaquo;	›	›
‾	&oline;	‾	‾
⁄	&frasl;	⁄	⁄
€	€	€	€
ℑ	&image;	ℑ	ℑ
℘	&weierp;	℘	℘
ℜ	&real;	ℜ	ℜ
™	™	™	™
ℵ	&alefsym;	ℵ	ℵ
←	←	←	←
↑	↑	↑	↑
→	→	→	→
↓	↓	↓	↓
↔	↔	↔	↔
↵	&crarr;	↵	↵
⇐	⇐	⇐	⇐
⇑	&uArr;	⇑	⇑
⇒	⇒	⇒	⇒
⇓	&dArr;	⇓	⇓
⇔	⇔	⇔	⇔
∀	∀	∀	∀
∂	∂	∂	∂
∃	∃	∃	∃
∅	∅	∅	∅
∇	∇	∇	∇
∈	∈	∈	∈
∉	∉	∉	∉
∋	&ni;	∋	∋
∏	∏	∏	∏
∑	∑	∑	∑
−	−	−	−
∗	&lowast;	∗	∗
√	√	√	√
∝	&prop;	∝	∝
∞	∞	∞	∞
∠	&ang;	∠	∠
∧	&and;	∧	∧
∨	&or;	∨	∨
∩	∩	∩	∩
∪	∪	∪	∪
∫	∫	∫	∫
∴	&there4;	∴	∴
∼	&sim;	∼	∼
≅	&cong;	≅	≅
≈	≈	≈	≈
≠	≠	≠	≠
≡	&equiv;	≡	≡
≤	≤	≤	≤
≥	≥	≥	≥
⊂	⊂	⊂	⊂
⊃	⊃	⊃	⊃
⊄	&nsub;	⊄	⊄
⊆	&sube;	⊆	⊆
⊇	&supe;	⊇	⊇
⊕	&oplus;	⊕	⊕
⊗	&otimes;	⊗	⊗
⊥	&perp;	⊥	⊥
⋅	⋅	⋅	⋅
⌈	&lceil;	⌈	⌈
⌉	&rceil;	⌉	⌉
⌊	&lfloor;	⌊	⌊
⌋	&rfloor;	⌋	⌋
⟨	&lang;	⟨	⟨
⟩	&rang;	⟩	⟩
◊	&loz;	◊	◊
♠	&spades;	♠	♠
♣	&clubs;	♣	♣
♥	&hearts;	♥	♥
♦	&diams;	♦	♦

253 of 253 entities. Invisible characters (spaces, joiners, soft hyphen) show as ·.

Runs entirely in your browser. Nothing you enter is sent to us or stored. Browse all free tools.

Found a problem, or something that could be better? We read every message and we fix things quickly.

This HTML entity encoder and decoder converts characters to and from HTML character references. Encoding turns the five characters that have special meaning in markup (< > & " ') into < > & " and ', so text can be shown on a page or placed in an attribute without being read as HTML. You can also encode every non-ASCII character, which helps when a template, email or legacy system mangles UTF-8.

Decoding handles named entities such as é and …, decimal references like é and hex references like é, following the HTML5 parser's own rules, including its quirks for invalid code points. Names outside the 253-entry built-in table are looked up by your browser's HTML parser, so all of HTML5's 2,000-plus names decode. Unknown names are left as they are and listed, rather than silently disappearing. This tool converts text; it is not an HTML sanitiser.

How to use

Choose Encode or Decode.
For encoding, pick the scope: only the five unsafe characters (enough for normal HTML), all non-ASCII, or everything except letters, digits and spaces.
Pick named, decimal or hex references. Named mode falls back to decimal for characters without a name.
Type or paste; the output updates as you type. Swap sends the output back to the input to check a round trip.
Search the reference table by name, character, decimal code or group (for example "arrow" or "greek") and copy an entity.

Frequently asked questions

Which characters must be escaped in HTML?

In text content, < and & must be escaped, because they start tags and entities. Inside an attribute value, also escape the quote character that delimits the attribute: " as " or ' as '. Escaping > as > is not strictly required but is conventional and harmless. Everything else, including accented letters and emoji, can appear as-is in a UTF-8 page.

What is the difference between   and a normal space?

  is U+00A0, a non-breaking space. Browsers do not wrap a line at it and do not collapse several of them into one, unlike ordinary spaces. It is useful to keep "10 kg" or "Mr. Smith" together on one line. Using rows of   for layout is a sign the job belongs to CSS instead.

Should I use ' or '?

' is defined in XML and HTML5 but not in HTML 4, so very old browsers and some email clients do not recognise it. ' works everywhere, which is why this encoder uses it for the apostrophe even in named mode. In a modern HTML5 page, either is fine.

Is HTML encoding enough to prevent XSS?

Escaping < > & " ' prevents injection into HTML text and quoted attribute values, which covers the most common case. It does not make a value safe inside a <script> block, a style attribute, an unquoted attribute, or a URL such as href="javascript:...". Each of those contexts needs its own encoding or validation. Use a templating engine that escapes by default, and a sanitiser such as DOMPurify when you must accept user HTML.

Why do I see &amp; or Ã© in my text?

&amp; means the text was HTML-encoded twice: & became &, then that & was encoded again. Decode once per extra layer. Ã© instead of é is not an entity problem but an encoding mismatch: UTF-8 bytes were read as Windows-1252 or Latin-1. Fix the charset declaration or the database connection encoding; entities only hide the symptom.

Named, decimal and hex references

HTML offers three ways to write the same character. A named reference such as © is readable but exists only for the characters HTML defines names for. A decimal reference such as © and a hex reference such as © work for every Unicode code point, including emoji: 🌲 is 🌲 or 🌲, one reference for the whole character, not two for its UTF-16 halves.

The 253 names in this tool's table are the HTML 4 set plus '. They are supported by every browser, email client and HTML library. HTML5 added about 2,000 more, mostly mathematical symbols (&NotEqualTilde;, &bigotimes;), which decode in modern browsers but are better written as plain UTF-8 or numeric references if older tools will touch the content.

Names are case-sensitive: É is É and é is é. A handful, such as &COPY; and &AMP;, also exist in uppercase for historical reasons, but the lowercase forms are the standard ones.

When to encode, and when not to

• Showing user input on a page: escape the five unsafe characters at output time, in the template, not when saving to the database.

• Code samples in a blog post or documentation: escape < and & so tags show as text.

• Email templates and legacy systems with unreliable UTF-8: encoding all non-ASCII to numeric references makes the content survive any charset.

• Modern UTF-8 pages: do not encode accented letters, curly quotes or emoji. Plain characters are smaller, searchable, and easier to edit.

• JSON, URLs and JavaScript strings: HTML entities mean nothing there. Use JSON escaping, percent-encoding or JavaScript string escapes respectively.

How numeric references are decoded

The HTML5 specification defines what a parser must do with odd numeric references, and this decoder follows it. , references to surrogate code points (&#xD800;) and values above U+10FFFF become the replacement character U+FFFD. References in the range  to  are read as Windows-1252, so  is an en dash and  is the euro sign, because that is what old pages meant when they wrote them.

Named references are decoded only when they end in a semicolon. Browsers also accept a few legacy names without one in text, such as &copy or &amp, but that behaviour depends on what follows, so content should always include the semicolon.

Related free tools

URL Encoder / Decoder — Percent-encode or decode text for URLs in component, full-URL or form mode, and edit a URL's query parameters in a table.
Base64 Encoder / Decoder — Encode text or files to Base64, turn images into data URIs with CSS and <img> snippets, and decode Base64 back to a previewable file. Nothing leaves your browser.
Meta Tag Generator — Fill in a page's title, description and social card details; get a complete, correctly escaped <head> block with live length counters.
JSON Formatter — Pretty-print, minify and validate JSON, with parse errors located by line and column. In your browser, no upload.