Skip to content
MtrXTools

HTML entity encode / decode

Escape text for HTML (< & "), decode named, decimal and hex entities back to text, and see every character's code point. Runs in your browser.

What it does

  • Escapes text for HTML: the five special characters & < > " ' only, or every non-ASCII character as well, as named (&eacute;), decimal (&#233;) or hex (&#xE9;) references.
  • Decodes named, decimal and hex references following the HTML parsing rules: legacy names without a semicolon (&copy 2024), invalid code points turned into U+FFFD, and references from 128 to 159 read as windows-1252 (&#150; is an en dash).
  • Spots double encoding such as &amp;lt; and decodes all the way in one go.
  • Lists every non-ASCII, special or invisible character with its code point, entity name and numeric references, which helps find stray non-breaking spaces and zero-width characters.

Text, attributes and what escaping can't fix

Between tags, only & and < must be escaped. Inside an attribute value, put the value in double quotes and escape & and "; an unquoted value ends at the first space, so escaping alone doesn't protect it.

HTML escaping is not enough inside <script> or <style>, in on* event handler attributes, or for URLs in href and src, where javascript: still runs. Those contexts need their own encoding, or no untrusted input at all.

Questions

Do I need to escape non-ASCII characters?
Not in a page served as UTF-8, which nearly all are. Escaping them is only useful when the text passes through something that isn't UTF-8 safe, such as an old email system or a file saved in another encoding.
Why does &amp;lt; show up on my page?
The text was escaped twice: once when stored and again when displayed. Decode it fully here to see the original, then fix the code so it escapes only once, at output.
What is the difference between &#39; and &apos;?
Both mean an apostrophe. &apos; is valid in HTML5 and XML but not in HTML 4, so &#39; is the safer choice and the one this tool uses.

Related tools