HTML Entity Encoder & Decoder

What HTML entities are

An HTML entity, properly a character reference, is a way of writing a character that would otherwise be read as markup, or that is hard to type or see. It starts with & and ends with ;, and comes in three forms that all mean the same thing:

• Named: —, readable but specific to HTML.
• Decimal: —, the Unicode code point in base 10.
• Hexadecimal: —, the same code point in base 16, matching the U+2014 notation.

Numeric references work for every Unicode character and in XML too. Named ones exist for 2,125 characters in HTML5, but XML, and so SVG and XHTML served as XML, knows only &, <, >, " and '.

Which characters you have to escape

On a page served as UTF-8, which is nearly all of them today, you only need entities for characters HTML itself would misread. Which ones depends on where the text goes:

Escaping all five of & < > " ', as this tool's default does, is safe in text and in either kind of quoted attribute. It is not enough on its own for values placed in a URL attribute (href="javascript:…" contains nothing to escape), in inline event handlers, or in CSS. Those need validation or their own encoding, such as percent-encoding for URL parts. Templating engines that escape automatically are the reliable fix for cross-site scripting.

Common HTML entities

Mistakes that show up on real pages

• Double encoding. Text escaped twice shows the entity itself: the page says & or " where a plain & or quote belongs. It happens when already-escaped data goes through a template that escapes again. Escape once, at output time.
• Missing semicolons. For compatibility with old pages, browsers still decode 106 names such as &copy, &not and &reg without a semicolon. So an unescaped link to ?a=1&copy=2 can display as ?a=1©=2. Escape the & in URLs inside HTML as &.
• Case. Names are case-sensitive. É is É and é is é, and   isn't an entity at all.
• Emoji as two references. JavaScript stores 😀 as two UTF-16 halves, 😀, but HTML needs the whole code point: 😀. References to either half on their own display as �.
• Windows code page numbers. – and “ are control characters in Unicode, but browsers render them as – and “ because old Windows pages meant that. Use the real code points (–, “) so other tools agree.
•   for layout. Strings of non-breaking spaces to indent or align text break on small screens and are read out oddly by screen readers. Use CSS for spacing, and keep   for pairs like 10 km that shouldn't split across lines.

FAQ

What is  ?

A non-breaking space (U+00A0). It looks like a normal space, but a line never breaks at it, and several in a row aren't collapsed into one. Its numeric forms are   and  .

Why does my page show & or "?

The text was escaped twice, so the browser decodes one layer and shows the second. Paste it into the decoder above: it will point out the double encoding. Then find the step that escapes data that was already escaped.

Do I still need entities for accented letters and symbols?

Not on a UTF-8 page. You can type é, —, € or ✓ directly. Entities remain useful for the characters HTML treats specially, for invisible ones like   and ­ that are easy to lose in an editor, and for output that must stay pure ASCII, such as some email templates. Choose "Also everything outside ASCII" above for that.

Should I use ' or '?

Both mean an apostrophe in HTML5. ' wasn't defined in HTML 4, and some older email clients don't recognize it, so ' is the safer choice and the one this tool writes.

How do I encode HTML entities in JavaScript?

For text you insert into a page, set element.textContent rather than innerHTML, and the browser treats it as text with no escaping needed. When you must build an HTML string, replace & first, then < > " '. Replacing & last would double-encode the entities you just wrote.

Related tools

• URL Encoder & Query Parser — Percent-encode text and break any URL into its parts.
• Format Identifier — Paste anything to find out what it is (a JWT, JSON, a certificate, Base64, a cron schedule and more), then open it in the right tool.

Related glossary terms

• HTML entity
• Percent-encoding