Which characters must be escaped in HTML?

In text and in quoted attribute values: & " and '. The minimal style writes them as & < > " and ' and leaves everything else, such as é and €, as typed, which is fine in a UTF-8 page.

Are HTML entity names case-sensitive?

Yes. Α is Α and α is α. &Copy; is not a name in the standard, so Decode leaves it as typed, while © is ©.

How many named HTML entities are there?

The HTML standard’s table has 2,231 entries: 2,125 names written with a semicolon, and 106 of them listed a second time without it, such as &copy and &amp. Decode reads all of them; the table is loaded the first time you decode or pick the names style.

Why does decode to the euro sign?

The HTML parser does not read 128 to 159 as control characters but through the windows-1252 table, where 128 is €. , surrogates and values above 10FFFF in hex decode to U+FFFD (�). When encoding, the tool leaves characters U+0080 to U+009F as they are, so they survive a round trip.

HTML Entity Encoder

Encode text to HTML entities (& < > " ') or decode any of the 2,231 named references in the HTML standard and numeric ones such as é. How it works

Input

Up to 500,000 characters. The output updates as you type.

Output

&lt;p class=&quot;note&quot;&gt;Tom &amp; Jerry&#39;s café costs 5 € — 5 &gt; 3&lt;/p&gt;

Encode style

Escaping these characters is correct for text and quoted attributes. It does not make input safe inside a script, a style block, a URL or an unquoted attribute.

About the HTML Entity Encoder

To show a character as text in HTML, write & as &, < as <, > as >, " as " and ' as '. This HTML entity encoder does that, and can also write other non-ASCII characters as numeric (é) or named (é) references. Decode reads the 2,231 named references of the HTML standard and every numeric form.

One line in each encode style

Encode style	Tom & Jerry's café: 5 € becomes
Minimal	Tom & Jerry's café: 5 €
All non-ASCII as numeric	Tom & Jerry's café: 5 €
Names where available	Tom & Jerry's café: 5 €

Common characters as HTML entities

Character	Names style	Numeric style
&	&	&
<	<	<
>	>	>
"	"	"
'	'	'
©	©	©
®	®	®
é	é	é
£	£	£
€	€	€
♥	&hearts;	♥
😀	😀	😀

The first five are escaped in every style. A character with no name in the standard, such as 😀, gets a numeric reference in the names style too.

How Decode reads unusual references

Input	Decoded	Why
Α α	Α α	Names are case-sensitive
&Copy;	&Copy;	Not a name in the standard, so left as typed
&copy	©	A legacy name, valid without the semicolon
&notit;	¬it;	The longest legacy name at the start, &not, is read
	€	128 to 159 are read as windows-1252 characters
	�	Zero becomes U+FFFD
&lt;	<	One pass: the result is not decoded again

Frequently asked questions

Which characters must be escaped in HTML?: In text and in quoted attribute values: & < > " and '. The minimal style writes them as & < > " and ' and leaves everything else, such as é and €, as typed, which is fine in a UTF-8 page.
Does encoding HTML entities prevent XSS?: Only in some places. Escaping these five characters is right for text and quoted attributes. It does not make input safe inside a script, a style block, a URL or an unquoted attribute, as the note under the tool says; those need escaping for that context.
Are HTML entity names case-sensitive?: Yes. Α is Α and α is α. &Copy; is not a name in the standard, so Decode leaves it as typed, while © is ©.
How many named HTML entities are there?: The HTML standard’s table has 2,231 entries: 2,125 names written with a semicolon, and 106 of them listed a second time without it, such as &copy and &amp. Decode reads all of them; the table is loaded the first time you decode or pick the names style.
Why does  decode to the euro sign?: The HTML parser does not read 128 to 159 as control characters but through the windows-1252 table, where 128 is €. , surrogates and values above 10FFFF in hex decode to U+FFFD (�). When encoding, the tool leaves characters U+0080 to U+009F as they are, so they survive a round trip.

When to encode or decode entities

Web developers and writers use it to show code or symbols as text: a <div> quoted in a blog post, a name with an apostrophe inside a quoted attribute, or a feed or CMS export full of & and ’ that needs reading. Decode turns references back into characters, and Use output as input sends the result the other way.

What is encoded and how decoding works

Encode always replaces five characters:

& → & < → < > → > " → " ' → '

The minimal style stops there. The numeric style also writes every other non-ASCII character as &#N;, with N in decimal. The names style uses the shortest name in the HTML standard where one exists (é → é) and &#N; otherwise (😀 → 😀).

Decode reads named references case-sensitively from the standard's table of 2,231 entries, and numeric ones in decimal or hex, with or without the semicolon: &#X41; and &#65 are both A. It works in one pass, so &lt; gives <.

Example: Tom & Jerry's café encodes to Tom & Jerry's café in the minimal style and to Tom & Jerry's café in the names style.

Limits: 500,000 characters.

Related Tools

View all tools

Dev

JSON Formatter

Paste JSON to format it with 2 spaces, 4 spaces or tabs, minify it or sort its keys. A syntax error is reported with its line, column and a caret under it.

Dev

JSON Path Query Tool

Test a JSONPath expression on your JSON and see the match count, each matching value and its path. Filters such as ?(@.price < 10) work. Up to 100 KB.

Dev

Base64 Converter

Encode text to Base64 or decode Base64 to text. UTF-8, standard and URL-safe alphabets, optional padding on decode, up to 250,000 characters.

Dev

URL Encoder/Decoder

Percent-encode or decode text as you type: one value with encodeURIComponent or a whole URL with encodeURI, and an option to read + as a space.

Dev

UUID Generator

Generate 1 to 1,000 random v4 UUIDs, or time-based v1, or name-based v5 and v3 from a namespace and a name, and copy them. Repeats of v4 are very unlikely.

Dev

ULID Generator

Generate 1 to 500 ULIDs, 26-character IDs that sort by creation time, in upper or lower case, and decode any ULID to the date it was made.