HTML Entity Encoder & Decoder
Encode text to HTML entities (named or numeric) and decode HTML entities back to plain text, instantly and entirely in your browser.
How this HTML entity encoder picks named entities and lets the browser handle decoding
Encoding text to HTML entities and decoding it back are asymmetric problems. Encoding requires deciding, character by character, whether a named entity exists or a numeric one is needed. Decoding just requires a complete, correct table of every entity HTML defines, which the browser already has built in. This tool takes the practical route on both: it ships a curated table of roughly 90 common named entities for encoding, and it hands decoding entirely to the browser’s own HTML parser instead of maintaining a second, inevitably incomplete table by hand.
Both directions run synchronously in your browser with no network calls. Decoding specifically works by setting the string as the innerHTML of a detached, never-rendered <textarea> element, then reading its .value back out, a technique that gets full HTML5 entity coverage for free instead of maintaining a lookup table by hand.
Four encoding modes, four different scopes
| Mode | What gets encoded |
|---|---|
| Special characters only | Just & < > " ', the five characters that are actually dangerous to leave raw inside HTML markup |
| Named entities | Any character with a known name in the table (like © or ë); anything else above code point 127 falls back to a decimal numeric entity |
| All non-ASCII | Special characters get named entities, everything else above code point 127 becomes numeric, ASCII text passes through untouched |
| Every character | All characters, including plain ASCII letters, become numeric entities |
Array.from(str) rather than a plain index loop, which correctly keeps surrogate pairs (emoji and other characters outside the Basic Multilingual Plane) as single units instead of splitting them into two broken halves.
codePointAt(0) to get the full Unicode code point (correctly handling astral characters), then format it as either &#x...; hex or &#...; decimal, per the format selector.
.innerHTML on a detached element and reading .value back means decoding automatically supports every entity the browser’s HTML parser recognizes, hundreds more than any hand-maintained encode table could practically include.
Hex vs. decimal numeric format
A separate format selector controls whether fallback numeric entities render as € or €, both valid per the HTML specification and decoded identically, the choice is purely about which convention your codebase or CMS prefers.
Swap button
Instantly exchanges the input and output boxes, letting you immediately re-run the opposite operation on whatever you just produced, useful for round-trip checking that encode and decode agree with each other.
Character reference specifications
- WHATWG HTML: Named character references is the authoritative, exhaustive list of every named entity a conforming browser must decode, the same list the decode step relies on implicitly.
- W3C HTML 4 entity sets documents the classic Latin-1, symbol, and special character entity sets that most of this tool’s named table draws from.
- MDN: HTML entity explains the general syntax rules for named and numeric character references.
- OWASP: Cross-Site Scripting (XSS) covers why encoding the five reserved characters matters when placing untrusted text into HTML output.
When escaping genuinely matters
Safely embedding user submitted text inside static HTML templates, preparing copyright and trademark symbols for a page footer without worrying about source file encoding, converting curly quotes and em dashes from a word processor export into entities that render correctly regardless of the page’s declared charset, decoding entity laden text copied from an RSS feed or scraped HTML back into plain readable text, and debugging why a string containing an ampersand or angle bracket is breaking an HTML template.
Frequently Asked Questions
An HTML entity is a piece of text starting with an ampersand and ending with a semicolon that represents a character which either has special meaning in HTML markup or can’t easily be typed or displayed directly, such as < for the less-than sign, & for an ampersand, or é for an accented e. Entities exist so that characters with syntactic meaning in HTML (like < and >, which start and end tags) can appear as literal text on a page without being interpreted as markup.
These five characters have special meaning in HTML syntax: angle brackets define tags, ampersands start entity references, and quotes delimit attribute values. If you insert user-generated or dynamic text directly into HTML without encoding these characters, a browser may misinterpret part of your content as markup, which can break your page’s layout or, more seriously, create a cross-site scripting (XSS) security vulnerability if the text comes from an untrusted source.
Named entities use a memorable, human-readable name like © for the copyright symbol, but only a finite, standardized set of names exist. Numeric character references use the character’s actual Unicode code point, either in decimal (©) or hexadecimal (©), and can represent absolutely any Unicode character, including emoji and rare symbols with no assigned name. Numeric references are the safer universal fallback when a character has no standard named entity.
Both represent exactly the same characters and are equally valid HTML, the choice is purely stylistic or based on convention in your codebase or tooling. Decimal is generally more common in hand-written HTML, while hexadecimal is often preferred in contexts that already reference Unicode code points in hex, such as programming documentation, since Unicode code points are conventionally written in hexadecimal (like U+00E9).
The full HTML5 specification defines over 2,000 named character references, far more than commonly appear in typical text, if this tool tried to maintain its own table, it would inevitably miss obscure ones. By handing the text to a real HTML parsing element and reading back its interpreted content, decoding is guaranteed to match exactly what any standards-compliant browser would render, with zero risk of an incomplete table.
This tool decodes entities into plain text within an input field for you to view and copy, it does not execute the result as live HTML or insert it into the page in a way that could run scripts, so viewing decoded output here doesn’t create an XSS risk on this page itself. That said, always re-encode dynamic or user-submitted text before inserting it into your own HTML output, regardless of what tool you used to inspect it.
Yes, this tool processes text using JavaScript’s Unicode code point iteration, so multi-byte characters and emoji spanning multiple UTF-16 code units are correctly treated as single characters when encoding, rather than being split into invalid surrogate halves. This ensures emoji and rare Unicode symbols round-trip correctly through the numeric entity modes.
From the blog
Deep dives on the things these tools touch
Minification, UUID collisions, diffing API responses, and the other questions that come up around this toolset.
