Loading...
Escape or decode HTML entities instantly, right in your browser.
Converts every character above ASCII (like é, ñ, or emoji) into a numeric entity such as é — useful for older systems that only accept plain ASCII.
HTML entities let you safely display reserved characters like &, <, >, ", and ' inside HTML without breaking the markup. This tool converts text to and from HTML entities entirely in your browser — nothing you paste is ever uploaded to a server.
What are HTML entities?
HTML entities are text sequences like & or ' that represent reserved or special characters in HTML, so browsers display them literally instead of interpreting them as markup.
Why does & need to be escaped?
The ampersand starts every HTML entity, so an unescaped & can be misread as the start of a broken entity. Escaping it as & keeps the character literal and the HTML valid.
Does this tool support decimal and hexadecimal entities?
Yes. Decode mode understands named entities (&), decimal entities (&), and hexadecimal entities (&) — they all resolve to the correct character.
When do I need to escape HTML?
Escape any text you plan to insert into an HTML page that comes from user input, a database, or another untrusted source — for example, comments, usernames, or form submissions. Rendering that text unescaped inside HTML is a common source of cross-site scripting (XSS) vulnerabilities, since characters like < and > can be interpreted as real markup.
Is emoji or non-English text affected?
Not unless you turn on "Encode non-ASCII characters." By default only the five reserved characters (&, <, >, ", ') are escaped, so accented letters, CJK text, and emoji pass through unchanged.
Named entities vs. numeric entities — which should I use?
Named entities like & are more readable and are what this tool produces by default. Numeric entities like & or & work in more restrictive contexts (such as XML or old parsers) that only recognize a small set of named entities, so use numeric form when compatibility is uncertain.
All conversion happens locally in your browser. Your text is never uploaded or stored on a server.