Escape text or HTML code as entities so it shows up as written on a web page, or turn entities like & and ' back into readable characters. Choose which characters to encode and whether to write them as named, decimal, or hex entities. Everything runs in your browser.
An HTML entity is a code that stands for one character. It starts with an ampersand and ends with a semicolon, like < for < or © for ©. The browser shows the character, not the code.
Entities exist because some characters mean something to HTML. A < starts a tag and an & starts an entity, so if you want a page to show them as text, you have to write them as < and &. Encoding does that for you. Decoding goes the other way and turns the codes back into characters.
Escapes only the five characters HTML reads as markup: &, <, >, and the two quote marks. Everything else, including accents and emoji, stays as it is. This is what you need to show code or user text on a web page.
<b>"Hi" & bye</b>After<b>"Hi" & bye</b>Also escapes every character outside plain ASCII: accented letters, symbols like © and €, emoji, and invisible ones like the non-breaking space. Use it when the page or file might not be saved as UTF-8.
café © 😀Aftercafé © 😀The default. Escapes every character except spaces, tabs, and line breaks, so even plain letters and digits become numeric references. The text looks the same in a browser but is unreadable in the source.
a@b.coAftera@b.coWrites characters by name where one exists, like é or ©. Names are easier to read in source code. The tool uses the 252 names from HTML 4, which every browser supports. A character without one of those names is written as a decimal reference instead.
é © 😀Afteré © 😀Writes each character as its Unicode code point in decimal, like é. Every character has one, so the output is consistent, and it works in both HTML and XML.
é © 😀Afteré © 😀Writes the code point in hex, like é. The number matches the U+ code you see in character tables (U+00E9), which makes it easy to look a character up.
é © 😀Afteré © 😀On by default. Escapes " and ' so the text is safe inside an attribute value. Turn it off to keep quotes readable when the text only goes between tags, where quotes are allowed as they are.
say "hi"Aftersay "hi"Choose Encode to turn text or HTML code into entities, or Decode to turn entities back into readable characters.
When encoding, choose which characters to escape and whether to write them as named, decimal, or hex entities. Turn off Encode quotes if the text only goes between tags.
Type or paste your text, click Encode or Decode, then copy the result or download it as a .txt file.
These are the entities you will run into most. Each column gives the same character, so you can use whichever form you prefer.
| Character | Named | Decimal | Hex | What it is |
|---|---|---|---|---|
| & | & | & | & | Ampersand |
| < | < | < | < | Less-than sign |
| > | > | > | > | Greater-than sign |
| " | " | " | " | Double quote |
| ' | ' | ' | ' | Apostrophe (single quote) |
| (space) | |   |   | Non-breaking space |
| © | © | © | © | Copyright sign |
| ® | ® | ® | ® | Registered sign |
| ™ | ™ | ™ | ™ | Trademark sign |
| € | € | € | € | Euro sign |
| £ | £ | £ | £ | Pound sign |
| – | – | – | – | En dash |
| … | … | … | … | Ellipsis |
| → | → | → | → | Right arrow |
| × | × | × | × | Multiplication sign |
' is valid in HTML5 and XML but was not part of HTML 4, so this tool writes an apostrophe as ' even in named mode. Both decode to the same character.
You do not have to escape every symbol. What needs escaping depends on where the text goes:
Only HTML characters escapes all five markup characters, which is safe in both text and attributes, and leaves the rest of your text readable.
If a page shows &, ", or ' where you expected &, ", or ', the text was escaped twice. The first pass turned & into &. A second pass then escaped the ampersand at the start of that entity, giving &amp;, which the browser shows as the literal text &.
To clean up the text, paste it into the tool on Decode and decode it once. If it was escaped more than twice, paste the result back in and decode again until it reads correctly. To stop it happening again, look for the place where text that is already escaped gets escaped a second time, such as a template that escapes a value your code has already encoded.
When you need to do this in code instead of by hand, these do the same job as the Only HTML characters setting above.
function escapeHtml(text) {
return text
.replaceAll("&", "&")
.replaceAll("<", "<")
.replaceAll(">", ">")
.replaceAll('"', """)
.replaceAll("'", "'");
}
escapeHtml(`<p class="note">Tom & Jerry's</p>`);
// "<p class="note">Tom & Jerry's</p>"function decodeHtml(text) {
const textarea = document.createElement("textarea");
textarea.innerHTML = text;
return textarea.value;
}
decodeHtml("café © 😀");
// "café © 😀"import html
html.escape("<p class=\"note\">Tom & Jerry's</p>")
# '<p class="note">Tom & Jerry's</p>'
html.unescape("café © 😀")
# 'café © 😀'Python's html.escape writes an apostrophe as ' (the hex form) rather than '. Both mean the same character.