Encode special characters as named or numeric HTML entities and decode entities back to text, with a reference table of the entities you will actually meet. Runs entirely in your browser — your numbers never leave this device.
| Character | Named entity | Numeric (decimal) |
|---|---|---|
| & | & | & |
| < | < | < |
| > | > | > |
| " | " | " |
| ' | ' | ' |
| © | © | © |
| ® | ® | ® |
| ™ | ™ | ™ |
| € | € | € |
| £ | £ | £ |
| — | — | — |
| … | … | … |
| × | × | × |
| ✓ | ✓ | ✓ |
| ° | ° | ° |
HTML reserves a handful of characters — < and > build tags, & starts an entity, quotes delimit attributes — so any of them appearing as ordinary text must be written as an entity, a stand-in the browser swaps back when it renders. This tool writes those stand-ins in two modes. Named mode uses the readable entities where they exist (<, &, ©) and falls back to numbers for characters that have no name in its table. Numeric mode writes every special or non-ASCII character as its decimal code point (©), which needs no name table at all and works in XML just as it does in HTML.
Decoding runs in reverse and handles all three spellings — named, decimal and hexadecimal — in a single pass, leaving anything it does not recognise exactly as written: &unknown; comes back as &unknown;, not as a guess. That one-pass rule matters, because it prevents the double-decode trap: &lt; decodes to the text <, which a page would display as < — decoding it a second time in your code would turn displayed text into a real tag opener.
Reach for encoding whenever text is inserted into markup and must stay text — user comments, code samples, prices with currency symbols in attributes. And note what entities are not: they are a display encoding, not a sanitiser. Encoding your own text is how you show it safely; it does not make untrusted markup safe to insert. All conversion runs in your browser, and pasted text is never uploaded.
Four are non-negotiable in text: & (&), < (<), > (> in practice), and the quote character that delimits any attribute the text sits inside — " (") in double-quoted attributes, ' (') in single-quoted ones. A raw & is the sneakiest, because browsers try to read what follows it as an entity and can swallow characters when it almost matches one.
Named entities are easier to read and audit in source (© says what it means), so prefer them in HTML you maintain. Numeric entities need no name to exist — every character has a code point — so they are the fallback for rare symbols, and the only choice in strict XML, which predefines just five names (&, <, >, ", '). Both forms render identically.
Because decoding is a single pass. & is the entity for &, so &lt; decodes to the literal text < — and when that text is placed in a page as already-encoded content, the browser displays it as <. Decoding twice would manufacture a real < out of text that was deliberately shown, which is how double-decoding bugs turn text into markup.
It is left exactly as written. &unknown; decodes to &unknown;, unchanged — inventing a replacement would corrupt text that may be perfectly meaningful in a fuller HTML entity set than the common table this tool carries. Unknown entities in a browser are likewise shown literally.
No. Encoding is how you display your own text inside markup without it being read as markup. It is not sanitisation: if you insert someone else's raw HTML into a page, entities do not neutralise scripts or event handlers embedded in it. Keep the jobs separate — encode text you print, sanitise markup you accept, with a dedicated library for the second.
No. Encoding and decoding run in your browser only — nothing you paste is uploaded, stored or tracked.
More in Developer Tools · Browse all tools