HTML Entity Encoder / Decoder
Escape or unescape HTML entities instantly as you type.
100% in your browser — nothing uploadedEscape HTML special characters online
About this HTML entity encoder
In encode mode, every character that can break HTML — the ampersand, angle brackets, and quotes — becomes a safe entity like & or <. An optional mode also converts all non-ASCII text: accented letters become named entities such as ñ and é, and anything without a common name gets a hex code like 😀. Decode mode reverses the process and understands named, decimal, and hex entities alike, leaving anything that isn’t a valid entity exactly as you pasted it.
It’s a daily helper for developers escaping user content before rendering it, writers pasting text into CMS fields or HTML email templates where accents get mangled, and anyone cleaning up scraped pages full of ' and & codes. Everything runs locally in your browser with JavaScript — the text you paste is never uploaded, logged, or stored anywhere.
The same character escapes differently by context
A single string has no one correct escape — where it lands decides. The five HTML rules cover element text and attribute values, but the moment that value goes into a <script> block or a URL, HTML entities are the wrong tool: the browser never decodes & inside JavaScript or a query string. Each context needs its own encoding, so "just escape it" is a bug waiting to happen.
| Context | What to encode | Example |
|---|---|---|
| HTML text | & < > become & < > | Ben & Jerry -> Ben & Jerry |
| HTML attribute value | & < > plus the quote that wraps it (" -> ", ' -> ') | title="a"b" breaks; write title="a"b" |
| JavaScript string | Not HTML entities — use \uXXXX (OWASP) | </script> -> \u003C/script> |
| URL / query value | Percent-encoding, %HH (a separate step) | n-tilde -> %C3%B1, space -> %20 |
So ask which context the value goes into first, then pick the encoder: this tool for HTML, the URL Encoder for URLs. HTML entity encoding inside a <script> or a URL does nothing useful, because neither is parsed as HTML.
The double-escaping bug: &amp;
The ampersand is itself a special character, which makes escaping non-idempotent — running it twice is not the same as running it once. Encode Ben & Jerry and you get Ben & Jerry. Push that already-escaped string through an encoder a second time and the & inside & is escaped again: & becomes &amp;. The page then renders the literal text & instead of &.
- In the HTML source, look for &amp; — or &lt;, &#241; — a named or numeric entity with amp; stuck in front of it.
- On the rendered page, a stray &, < or ñ showing up as visible text is the tell: the value was escaped one time too many.
- Fix it by decoding once (paste it into decode mode), not by encoding again. Escape at exactly one layer — either the template escapes the data, or the data arrives pre-escaped, never both.
Reference tables
FAQ
Which characters do I always need to escape in HTML?
Five: the ampersand (&), the angle brackets (< and >), the double quote ("), and the single quote ('). The first three stop text from being read as markup; the quotes matter inside attribute values. The default mode covers exactly these.
What’s the difference between ñ, ñ, and ñ?
They all produce the same character: ñ. The first is a named entity, the second is decimal, and the third is hexadecimal. Browsers accept all three. This tool encodes to a named entity when a common name exists, hex otherwise, and decodes any of the three notations.
Is it safe to decode HTML that contains script tags?
Yes. Decoding converts entity codes into plain text characters — the result only ever lands in a text box and is never rendered or executed as HTML. And since everything runs in your browser, the content is never uploaded either.