About HTML Entities
HTML entities are short escape sequences — like & for & or < for < — that let you write characters which would otherwise be interpreted as part of HTML markup. Without them, a page that needs to display the literal string 'a < b' would see that line as the start of an unknown tag, and browsers would silently do the wrong thing. Entities are how HTML represents those characters safely inside a document.
The most important entities in day-to-day web work are the ones for the five reserved characters: < (<), > (>), & (&), " ("), and ' ('). These are the characters that can break a page or open a cross-site-scripting vulnerability if they appear unescaped inside attribute values or text content. Any user-supplied text that gets rendered as HTML should have those five escaped.
This tool encodes text by replacing reserved characters with their entity equivalents, or decodes an entity-encoded string back to its original form. Both directions run in your browser. It is useful for preparing snippets to paste into CMS fields, debugging an encoding problem, or understanding what a string actually represents when you see &amp; somewhere it should not be.
How to Encode and Decode HTML Entities
- Paste your text into the input area.
- Choose encode to escape reserved characters, or decode to turn entities back into their original characters.
- Copy the result with the copy button.
Examples
Encoding reserved characters
Input
<a href="/search?q=tea&cake">tea & cake</a>
Output
<a href="/search?q=tea&cake">tea & cake</a>
Decoding a double-encoded string
Input
&amp;
Output
&
A common bug: an already-encoded string was encoded a second time. Decode once and you get &; decode again and you get &.
Common Use Cases
- Pasting code samples into a blog post without them being parsed as HTML.
- Storing user input in a database and displaying it later without XSS risk.
- Debugging CMS or email templates where text is showing up as literal < instead of <.
- Preparing documentation that needs to show raw HTML tags as text.
Tips
- Escape context-appropriately. HTML text, HTML attributes, JavaScript strings, and URLs all require different escaping. Using HTML entities inside a JavaScript string does not stop a script injection.
- If you are escaping user input to prevent XSS, do it at render time, not at storage time. That way you always know the stored value is the original input and the encoding matches the output format.
- Numeric entities (' or ') and named entities (') are equivalent. Most codebases prefer named entities for readability, falling back to numeric when no named entity exists.
Frequently Asked Questions
Which characters must be encoded?
At minimum, the five reserved characters: <, >, &, ", and '. For attribute values you also need to escape the quote character used to delimit the attribute. For everything else (accented letters, emoji, non-Latin scripts), modern HTML with UTF-8 can hold them directly and no entity is needed.
Is HTML entity encoding the same as URL encoding?
No. URL encoding (%20 for space) escapes for URLs; HTML entity encoding (& for &) escapes for HTML. They solve different problems and are not interchangeable.
What about ' versus '?
Both represent the apostrophe character. ' is universally supported in HTML; ' was not part of HTML 4 and is still occasionally avoided in email clients. When in doubt, use '.
Is my input sent to a server?
No. The conversion runs entirely in your browser.