Encode text to HTML entities or decode named, decimal and hexadecimal entities back to text. Choose named or numeric output, encode non-ASCII characters, and see a clear warning for invalid entities. Output stays plain text.
HTML Entity Encoder & Decoder converts text to and from HTML character references. In Encode mode it replaces the five HTML-special characters — & < > " and ' — with entities, and can also encode every non-ASCII character such as é, € or emoji. You choose named entities where one exists (for example ©), decimal references (©) or hexadecimal references (©). An option to encode only non-ASCII characters is included for cases where markup must stay untouched; the tool warns you when that leaves HTML-special characters unencoded.
In Decode mode it turns valid named, decimal and hexadecimal entities back into characters. Named entities are looked up with your browser’s built-in HTML entity table. Anything that is not a valid entity — an unknown name, a missing semicolon, a code point outside Unicode or in a range HTML forbids — is left exactly as it was and listed in a warning, so nothing is silently removed. The output is always shown in a plain text box and is never rendered as HTML. This tool converts characters only; it does not sanitise HTML and is not protection against every kind of cross-site scripting.
In element content, & and < must be encoded, and > is usually encoded too. Inside quoted attributes the matching quote must be encoded as well. This tool encodes all five — & < > " and ' — when HTML-special characters are selected.
They all represent the same character. A named entity uses a name such as ©, a decimal reference uses the code point in base 10 (©) and a hexadecimal reference uses base 16 (©). Not every character has a name; in named mode those characters fall back to decimal.
It was not a valid entity: for example an unknown name, a missing semicolon, a value of zero, a surrogate code point, a value above U+10FFFF or a code in the C1 control range (128–159), which HTML treats as an error. The warning lists each one, and the text is kept exactly as you entered it.
No. The decoded result is placed in a plain text box and is never inserted into the page as HTML. Named entities are looked up by name only, in an inert document that does not run scripts.
No. It only converts characters to and from entity references. Encoding text correctly for its context is one part of preventing cross-site scripting, but it is not a sanitiser and does not make untrusted HTML safe.
Yes, ' is valid in HTML5 and XML. Very old HTML 4 software may not recognise it; if that matters, use the decimal (') or hexadecimal (') format instead.
No. Encoding and decoding run entirely in your browser and nothing is stored or sent to a server.
