HTML Entity Encoder and Decoder

What this tool does

This HTML entity encoder escapes text so a browser renders it instead of interpreting it, and decodes entities back into the characters they stand for. Two scopes are available: the five characters that change what markup means, or those plus every character above ASCII.

The default is the narrow one, and that is a deliberate choice. Escaping only what has to be escaped keeps the source readable and the diff small; escaping everything above ASCII turns a paragraph of French into a wall of é for no gain on any page served as UTF-8, which is every page you will write this decade.

How to use it

1. Choose encode or decode.
2. When encoding, decide whether non-ASCII characters should be escaped as well.
3. Paste your text or your markup.
4. Copy the result.

Decoding handles named entities from an embedded table of 150, plus decimal references like — and hexadecimal ones like 🎉. A name the table does not know is left exactly as written and listed underneath, which is what a browser does and the honest thing for a tool to do.

When escaping is the security control

Every value that came from outside your application and ends up inside a page has to be escaped for the place it lands. That is the whole of the defence against cross-site scripting, and the reason < is dangerous is not that it is punctuation but that it starts a tag.

The catch is that "escaped" is context-dependent, and the five-character rule only covers two contexts:

• Element content — <p>HERE</p>. Escaping & < > is sufficient.
• A quoted attribute value — <a title="HERE">. Escape the delimiting quote as well.

It is not sufficient anywhere else. Inside a <script> block the parser is reading JavaScript, and < is a syntax error rather than protection. Inside an unquoted attribute a space is enough to inject a new attribute, so escaping quotes achieves nothing. In href the payload never needs a special character at all: javascript:alert(1) is entirely alphanumeric and escaping leaves it intact, which is why URLs need scheme validation on top of escaping.

Use this tool to understand and repair a value. Use your template engine's automatic escaping to protect a page — it knows which context it is writing into, and a human doing it by hand eventually misses one.

Entities inside attributes

An attribute value is parsed for entities just like element content, which surprises people who assume quotes make it literal. title="AT&T" renders as AT&T; title="AT&T" is invalid and browsers repair it silently, differently from each other.

Two practical consequences. First, the ampersand in a query string inside an href must be written & — ?a=1&b=2 is the correct markup for the URL ?a=1&b=2, and it has been since HTML 4. Second, a value that has been percent-encoded for a URL still needs entity escaping for the attribute; the two encodings stack rather than replace each other, and the URL encoder and decoder is the first half of that pipeline.

The apostrophe, and why this tool writes '

There are two ways to escape a single quote, and only one of them is universally safe. ' was defined in XML and only became a named entity in HTML 5; a document parsed as HTML 4 or served to a very old parser can render it literally. ' is a numeric reference and has always worked everywhere, so that is what the encoder emits.

It is a small thing that shows up in old bug reports as stray ' text on the page, usually after markup travelled through a system that reparsed it. When you decode text and find literal entity names on screen rather than characters, that is the signature: something escaped the text twice, or decoded it into an attribute that was then escaped again. Encoding is not idempotent, and the Base64 encoder page describes the same failure in its own alphabet.