HTML Entity Encoder & Decoder
Encode & < > " ' for HTML, optionally every non-ASCII character as a named (HTML 4.01) or numeric entity; decode named and numeric references back to text.
Escaped HTML text or decoded plain text with the number of replacements, unknown names left intact and listed, and a warning when decoding produces markup.
Example: <a href="x">Tom & Jerry's é</a> encodes to <a href="x">Tom & Jerry's é</a>; with "named" the é becomes é and € becomes €.
Five characters always,
the rest on request.
Which characters must be escaped, where the names come from, and what decode will and will not do.
Encoding
Ampersand, less-than and greater-than are always encoded; double and single quotes are encoded unless switched off (needed inside attribute values, harmless elsewhere; the single quote uses ' because ' is HTML5-only). Non-ASCII characters are kept by default — HTML pages are UTF-8 — or written as named references where HTML 4.01 has a name (252 names: eacute, euro, nbsp, mdash …), otherwise as decimal or hexadecimal numeric references.
Decoding
Named references from the HTML 4.01 table plus ', and all numeric references, are replaced; a name not in the table (HTML5 added about 2,000, mostly mathematical) is left as it is and listed. Numeric references outside Unicode, in the surrogate range or zero are not decoded.
Limits
This is text escaping, not sanitising: decoding <script> yields a script tag, and the page says so. The tool does not know where in a document the text sits. Nothing leaves the browser; the same four anonymous usage counts as the rest of the site apply.
SOURCES
Last reviewed 20 September 2026. How results are checked: How we verify.