What HTML Entity Encoder & Decoder does
This tool converts in both directions. In Encode mode it replaces the five characters that have a special meaning in HTML: & becomes &, < becomes <, > becomes >, the double quote becomes " and the apostrophe becomes '. Everything else is left alone unless you choose the extended option, which also writes every non-ASCII character as a decimal reference such as é for é. In Decode mode it resolves every decimal and hexadecimal reference plus 20 of the most common named entities. Each run peels off exactly one layer, which makes it easy to see when text has been escaped twice.
HTML entity codes chart: named, decimal and hex
These are the 20 named entities the decoder recognises, with the numeric forms that refer to the same character. Decimal and hex references for any other Unicode character are decoded too.
| Character | Named entity | Decimal | Hex | Description |
|---|---|---|---|---|
| & | & | & | & | Ampersand |
| < | < | < | < | Less-than sign |
| > | > | > | > | Greater-than sign |
| " | " | " | " | Double quote |
| ' | ' | ' | ' | Apostrophe |
| (space) | |   |   | Non-breaking space |
| © | © | © | © | Copyright sign |
| ® | ® | ® | ® | Registered sign |
| ™ | ™ | ™ | ™ | Trade mark sign |
| … | … | … | … | Ellipsis |
| — | — | — | — | Em dash |
| – | – | – | – | En dash |
| ‘ | ‘ | ‘ | ‘ | Left single quote |
| ’ | ’ | ’ | ’ | Right single quote |
| “ | “ | “ | “ | Left double quote |
| ” | ” | ” | ” | Right double quote |
| é | é | é | é | e with acute accent |
| € | € | € | € | Euro sign |
| £ | £ | £ | £ | Pound sign |
| ° | ° | ° | ° | Degree sign |
Other named entities, such as ♥, × and →, are left unchanged by the decoder. Use their numeric form if you need them resolved here.
Encoding examples: escaping HTML so it displays as text
Each result below is the exact output of the tool for the input shown.
A link with a query string and quotes (the default sample)
<a href="/docs?a=1&b=2">Tom & Jerry's "guide"</a>
<a href="/docs?a=1&b=2">Tom & Jerry's "guide"</a>
All five unsafe characters appear in this one line, so it is a good test of any escaping routine.
A script tag you want to show, not run
<script>alert("hi")</script>
<script>alert("hi")</script>
A code condition inside a paragraph
if (a < b && c > d) { print("ok"); }
if (a < b && c > d) { print("ok"); }
Accents, symbols and emoji with Unsafe plus all non-ASCII
Café © 2026 — 5 € ☕ 😀
Café © 2026 — 5 € ☕ 😀
With Only HTML-unsafe characters selected, the same input comes back unchanged because it contains none of the five.
Encoding text that is already encoded
AT&T
AT&amp;T
The encoder does not detect existing entities. Encode raw text only, or you create the double-encoding problem described below.
Decoding examples, including double-encoded text
Escaped comparison from a database field
5 < 10 && 10 > 5
5 < 10 && 10 > 5
The Summary panel reports 30 characters in and 16 out.
One extra layer
&lt;b&gt;
<b>
The output is still escaped, which tells you the source was encoded twice. Decode it again to reach <b>.
Two extra layers
&amp;lt;b&amp;gt;
&lt;b&gt;
Three passes are needed in total, so three stages in the pipeline are escaping where one should.
Mixed named, decimal and hex references
© © © 😀 😀
© © © 😀 😀
Why the ampersand must be escaped first
Every entity begins with an ampersand, so the ampersand is the one character whose order matters. If a routine replaced < with < first and then replaced every & with &, the ampersand it had just written would be escaped too, giving &lt;. The browser would then display the five characters < instead of a less-than sign.
The same mechanism explains double encoding in real systems. A template engine escapes a value, a later stage escapes the already safe string again, and each pass adds one more amp; to every entity. Three passes turn a quote into &amp;quot;. Decoding one layer at a time, as this tool does, shows you how many stages are involved, which is usually one more than you intended.
What this encoder and decoder does not do
- Encoding never produces named entities beyond the five. Extended mode writes decimal references such as ©, not ©, and there is no hex output option.
- Named entities are matched without regard to case, so É decodes to lowercase é. Use É when you need the capital É.
- An entity needs its closing semicolon to be decoded. < without the semicolon is left as typed.
- Hex references are recognised with a lowercase x only. A decodes to A, while A is left as typed.
- Entity encoding protects text placed in HTML content or a quoted attribute. Text going into a script block, a URL or a CSS value needs the escaping rules of that context instead.
- Nothing is sent to a server. Both directions run in your browser, so pasting content from a database or a support ticket does not transmit it.
Step by step
- 1
Set Mode to Encode — text to entities, or to Decode — entities to text.
- 2
Paste your text or markup into the Input box, replacing the sample link.
- 3
When encoding, choose Only HTML-unsafe characters to keep accents and emoji readable, or Unsafe plus all non-ASCII to turn those into numeric references as well.
- 4
Copy the Encoded HTML or the Decoded text from the result panel.
- 5
If decoded output still contains entities, paste it back in and decode again. Each pass removes one layer.