HTML entity encoder
Escape special characters to HTML entities for safe display, or unescape entities back to the original characters.
What this tool does
HTML treats certain characters specially: < starts a tag, & starts an entity, " delimits attribute values, and so on. To display these characters literally in a web page, they have to be written as HTML entities — <, &, ", etc. This tool converts between the two forms in both directions.
The five characters that always need escaping
| Character | Entity | Why |
|---|---|---|
| & | & | Always — otherwise the parser tries to start an entity. |
| < | < | Always — otherwise the parser tries to start a tag. |
| > | > | For symmetry. Not strictly required, but good practice. |
| " | " | Inside attribute values delimited by double quotes. |
| ' | ' | Inside attribute values delimited by single quotes. |
These five together are sometimes called the "OWASP minimum" — escape these and you've prevented the most common cross-site-scripting vulnerabilities from user-supplied text.
Escape all non-ASCII?
With "Encode all non-ASCII to entities" turned on, every character above ASCII 127 is also converted to a numeric entity (ü for ü, etc.). This is rarely necessary in modern web pages — UTF-8 is universally supported — but it's still useful when the destination system specifies a non-UTF-8 character set, or when debugging a display issue.
Decoding
The decoder accepts both named entities (&) and numeric entities (& or &). It uses the browser's HTML parser, so all 2,200+ named entities defined in the HTML standard are supported.
When to escape
Always escape user-provided text before inserting it into HTML. Templating languages (Jinja, ERB, Vue, React) escape by default. This tool is for one-off encoding; production code should use the framework's built-in escaping.
Privacy
Encoding and decoding happens in your browser.
Frequently asked questions
Do I really need to escape >?
& and < are required inside text. But escaping > for symmetry is conventional.What's the difference between ' and '?
' is not part of HTML4 (only HTML5 and XML), so the numeric form ' is more portable.Does the tool encode characters inside script or style tags?
<script> or <style>. Those contexts have their own escaping rules.