HTML entity encoder and decoder
Escape text so it displays safely in HTML, or turn &entities; back into characters. Choose minimal escaping or convert every special character.
Why escaping matters
A browser reads < as the start of a tag and & as the start of an entity. If user text containing <script> is dropped into a page unescaped, the browser runs it. Encoding turns those characters into < and &, which display as the symbols but are never parsed as markup.
Minimal mode is what templating engines such as React, Vue and Jinja apply automatically. The other modes are for ASCII-only destinations. Numeric entities work for every Unicode character; their numbers are the code points shown by the Unicode converter.
Putting text into a URL instead? That needs percent-encoding. Into a JavaScript or JSON string? Use the string escape tool.
Questions people ask
What are HTML entities?
Entities are text codes that stand for a character in HTML. They start with & and end with ;. Named entities use a word (© for ©), numeric ones use the code point in decimal (©) or hex (©).
Which characters must be escaped in HTML?
In text content, & and < must be escaped. Inside attribute values also escape the quote character you used (" or '). Escaping > is optional but common. These five cover what is needed to prevent markup injection.
Do I need entities for accented letters and emoji?
Not if your page is served as UTF-8 (<meta charset="utf-8">), which is the norm. Use “Named” or “Numeric” mode only when the target system is ASCII-only, such as some email templates.
How do I decode HTML entities?
Switch to Decode and paste the text. Named, decimal and hex entities are all converted back to characters.
Is escaping entities enough to stop XSS?
It stops injection in normal text and quoted attributes. It is not enough inside <script> blocks, event-handler attributes, CSS or URLs (javascript: links), which each need their own context-specific encoding. OWASP’s XSS Prevention Cheat Sheet covers each context.