HTML entity encoder and decoder

In HTML, some characters have special meaning. < starts a tag, & starts an entity, and quotes end attribute values. If you want those characters to appear as text, for example to show a code sample in a blog post, they must be written as entities:

Character	Entity
<	&lt;
>	&gt;
&	&amp;
"	&quot;
'	&#39;

So <p class="title">Tom & Jerry</p> encoded becomes <p class="title">Tom & Jerry</p>, which a browser displays exactly as typed instead of rendering a paragraph.

• Only the required ones (< > & " '): the right choice for showing code on a page or putting text into HTML attributes. Your page is UTF-8, so accented letters and symbols can stay as they are.
• Also accented letters and special symbols: converts every non-ASCII character to a named entity like ©, — or € where one exists, or a numeric entity like é for é. Useful for old systems, email templates or files that are not UTF-8.
• Every non-alphanumeric character: encodes all punctuation too. Rarely needed, but handy for obscuring text in some templating situations.

Decoding understands named entities, decimal entities (©) and hex entities (©).

Encoding is the main defense against cross-site scripting (XSS). If a site inserts user input into a page without encoding it, an attacker can submit <script>…</script> and the browser will run it for every visitor.

Rules of thumb:

• Encode user input when it is output into HTML, not when it is stored.
• Use your framework's built-in escaping: React, Vue, Angular, Django, Rails and Laravel templates encode by default. Be careful with "raw HTML" escape hatches like dangerouslySetInnerHTML or v-html.
• HTML encoding is not enough for every context. Values inside <script>, inline event handlers, CSS or URLs need context-specific escaping. For URLs, use the URL encoder.

This tool is for one-off conversions; production code should rely on a tested library.

Entity	Character	Name
 	(non-breaking space)	keeps two words on one line
© ® ™	© ® ™	copyright, registered, trademark
– —	– —	en dash, em dash
…	…	ellipsis
×	×	multiplication sign
°	°	degree
€	€	euro

Typing the characters directly is fine in UTF-8 pages; entities are mainly useful when you cannot be sure of the encoding. To look up any character's code, use the Unicode character tool.

You often meet encoded text where it was not meant to be seen: product titles in an RSS feed showing &, CSV exports full of ", or email subjects with ’ instead of an apostrophe. Paste such text in Decode mode to get clean characters back.

If the text was encoded twice, for example <, decode it twice. And if instead of entities you see garbled sequences like é or ’, that is a character encoding problem, not HTML encoding: use the text encoding fixer.