HTML Entity Encoder and Decoder, Free and Private
Encode text as HTML entities and decode named, decimal and hex character references back to text in your browser. Special characters only, non-ASCII or everything, decimal or hex. Nothing is uploaded.
0 characters, 0 bytes
0 characters, 0 bytes
About the HTML Entity Encoder and Decoder
The HTML Entity Encoder and Decoder turns text into HTML character references and back. Encoding replaces characters that have a special meaning in HTML, such as <, > and &, with references like <, > and &, so a browser shows them as text instead of reading them as markup. Decoding does the reverse: it reads named references such as é, decimal references such as é and hexadecimal references such as é, and gives you the plain characters. The output updates as you type. Everything runs in your browser; your text is never uploaded.
How to use it
Steps
- Choose Encode or Decode.
- Type or paste your text. The result appears on the right with a character and byte count.
- When encoding, pick which characters to encode and, for the numeric modes, whether numbers are written in decimal or hexadecimal.
- Press Copy to copy the result, or Swap to move it into the input and reverse the direction, which is a quick way to check a round trip.
Encoding modes
Special characters only
Encodes the five characters that matter in HTML text and attributes: & as &, < as <, > as >, " as " and ' as '. Everything else, including accented letters and emoji, is left alone. This is the right choice for showing code or user input on a page served as UTF-8, which is almost every modern page.
Non-ASCII too
Also encodes every character outside ASCII. Characters with a name in the HTML5 list use it, so é becomes é and — becomes —; the rest, such as emoji, become numeric references. Use it when the text must pass through a system that only handles ASCII, such as an old template engine or an email header.
Everything
Writes every character, letters and spaces included, as a numeric reference. The result is long and hard to read, but it contains nothing a parser could misread. Characters outside the Basic Multilingual Plane, such as 😀, become a single reference (😀), never two surrogate halves.
Decoding
The decoder understands every one of the more than 2,000 named character references of the WHATWG HTML standard, plus decimal and hexadecimal numeric references. It follows the browser's rules for text content, so a few legacy names such as & and © are recognised even without the final semicolon. A reference it does not know, such as &bogus;, is kept exactly as written rather than removed, so nothing in your text is lost.
Privacy
Encoding and decoding happen entirely in your browser. Nothing is uploaded to our servers, and nothing is kept once you close or reload the tab.
Related tools
To indent or tidy a whole HTML document, use the HTML Formatter. Text that goes into a URL needs percent-encoding instead of HTML entities; the URL Encoder and Decoder does that. For binary data in a text field, try the Base64 Encoder.
Open-source credits
- Encoding and decoding of named references use html-entities by Marat Dulin, MIT licence.
- The named references come from the WHATWG HTML named character references list. The "Everything" mode writes numeric character references as defined by the same standard, with code on this site.
Frequently asked questions
Which characters must be encoded in HTML?
In text content, & and < must be encoded, and > is encoded by convention. Inside attribute values the quote character that delimits the value must be encoded as well. The Special characters only mode encodes all five of &, <, >, double quote and apostrophe, which is safe in both places.
Do I need to encode accented letters and emoji?
Not on a page served as UTF-8, which is the default for modern HTML. Characters such as é or 😀 can appear as they are. Encode them only when the text must pass through a system limited to ASCII; the Non-ASCII too mode does that, using names such as é where they exist.
What is the difference between named, decimal and hexadecimal references?
They are three spellings of the same character. © uses a name from the HTML standard, © gives the Unicode code point in decimal and © gives it in hexadecimal. Browsers treat all three identically; numeric references work for every character, while names exist only for about 2,000 of them.
Does HTML encoding protect against cross-site scripting?
Encoding the special characters stops text from being read as markup when it is placed in HTML content or a quoted attribute, which is the most common XSS defence. It is not enough inside script blocks, style blocks, URLs or unquoted attributes, which each need their own escaping, so prefer your framework's built-in escaping.
Is my text sent anywhere?
No. Encoding and decoding run in your browser with the html-entities library, and nothing you type is uploaded or stored.