QiLing Tools
Sign in

🔣HTML Entity Encoder & Decoder - Escape HTML

Turn < > & " ' into &lt; &gt; &amp; &quot; &#39; so they display literally on a web page instead of being read as tags, or turn HTML full of entities back into plain text. You can escape all five characters (safe inside attribute values) or only < > & (shorter output). Non-ASCII characters such as Chinese or emoji can be kept as they are, written as decimal &#20013; or hex &#x4E2D;, and common symbols like ©, €, — and the non-breaking space can use names such as &copy; &euro; &mdash; &nbsp;. Emoji are encoded as whole characters, so 😀 becomes &#128512; rather than two broken entities. After decoding, invisible characters like non-breaking spaces and zero-width characters are counted and can be cleaned up with one click. Everything runs in your browser.

Loading tool...

How to use HTML Entity Encode/Decode

  1. 1Choose Encode or Decode
  2. 2When encoding, choose which characters to escape and how to write non-ASCII characters, and tick named entities if you like
  3. 3Paste your text; the result updates live, then click Copy result
  4. 4If the decoded result contains invisible characters, decide whether to replace them with normal spaces

FAQ

Why escape, and which characters must be escaped?
A browser reads < as the start of a tag and & as the start of an entity, so to show text like <b> or Tom & Jerry you must write &lt;b&gt; and Tom &amp; Jerry. In element text, escaping < > & is enough. Inside attribute values (title="…", alt='…') quotes must be escaped too, or the attribute ends early, breaking the page and, at worst, letting someone inject a script. When unsure where the text will go, escaping all five is safest.
Why is the apostrophe written &#39; and not &apos;?
&apos; comes from XML and was only officially added in HTML5; old HTML 4 and some older email clients do not recognize it. The numeric form &#39; works in every browser and email client, so this tool uses it. Both decode correctly.
What is the difference between decimal, hex and named entities?
They all represent the same character and render identically. For 中, decimal is &#20013; and hex is &#x4E2D; (matching the Unicode code point U+4E2D), or you can keep the character itself. Only common symbols have names, e.g. © is &copy;, € is &euro; and the non-breaking space is &nbsp;, which are easier to read than numbers; HTML5 defines over two thousand names, but CJK characters have none. Almost every page today is UTF-8, so you can write such characters directly; numeric entities are only needed when the page encoding is uncertain or the output must be pure ASCII.
How much bigger does text get with numeric entities?
In UTF-8 a Chinese character takes 3 bytes, but &#20013; takes 8, about 2.7 times as much; 😀 takes 4 bytes, while &#128512; takes 9. So converting all non-ASCII text to entities is not recommended unless you need it.
Why did emoji used to turn into garbage when encoded?
Emoji like 😀 occupy two code units (a surrogate pair) inside JavaScript. Converting unit by unit produces two entities, &#55357;&#56832;, neither of which is a valid character on its own, so the browser shows �� and the emoji is lost. The correct approach is to encode the whole character as one entity, &#128512; (hex &#x1F600;), which is what this tool does; all three output styles decode back to the original in testing.
What are the non-breaking spaces and zero-width characters it warns about?
&nbsp; decodes to a non-breaking space (U+00A0), which looks like a normal space but is a different character, so after pasting into code, Excel or a database, comparisons fail and searches miss. Zero-width characters such as &#8203; are completely invisible yet make identical-looking strings differ, and &shy; is a soft hyphen that only appears at a line break. The tool counts them after decoding, and Use normal spaces and remove invisible characters cleans the result without touching your input.
Is this the right escaping for JavaScript or URLs?
No. HTML entities only apply to HTML text and attributes. Inside a JavaScript string you need escapes like \" \n \u4E2D, which String Escape / Unescape handles; in URL parameters you need percent-encoding such as %E4%B8%AD, which URL Encode/Decode handles; to look up a character's code point, use Unicode Converter. HTML entities have no effect inside <script>.
Can decoding run scripts in the text?
No. Decoded content is parsed purely as text: &lt;img src=x onerror=alert(1)&gt; decodes to a string of characters and never loads an image or runs code.
Are my files or data uploaded?
No. Everything runs locally in your browser with no network upload, and is discarded when you close the page.
Do I need to sign up or pay?
No. The site is completely free, needs no account and has no usage limits.

Features

  • Escapes < > & " ', or only < > & if you prefer
  • Non-ASCII characters kept as is, or written as decimal or hex numeric entities
  • About 50 common symbols available as named entities, e.g. &copy; &euro; &nbsp; &mdash;
  • Emoji and other supplementary characters encoded by full code point, never garbled
  • Decodes every named and numeric entity, and flags non-breaking spaces, zero-width characters and soft hyphens
  • Live conversion, runs locally, nothing uploaded