# HTML Entity Encoder & Decoder - Escape HTML

> Free HTML entity encoder and decoder. Escape < > & " ' as decimal, hex or named entities, encode emoji correctly, and spot hidden &nbsp;.

- URL: https://qilingtools.com/en/html-entity
- Category: Developer Tools (https://qilingtools.com/en/dev)
- Tags: [Developer](https://qilingtools.com/en/tags/dev), [Frontend](https://qilingtools.com/en/tags/frontend), [Encoding](https://qilingtools.com/en/tags/encode)
- Last updated: 2026-11-07
- Price: Free, no sign-up
- Privacy: Runs locally in the browser; files are never uploaded

Turn < > & " ' into &lt; &gt; &amp; &quot; &#39; so they display literally on a web page instead of being read as tags, or turn HTML full of entities back into plain text. You can escape all five characters (safe inside attribute values) or only < > & (shorter output). Non-ASCII characters such as Chinese or emoji can be kept as they are, written as decimal &#20013; or hex &#x4E2D;, and common symbols like ©, €, — and the non-breaking space can use names such as &copy; &euro; &mdash; &nbsp;. Emoji are encoded as whole characters, so 😀 becomes &#128512; rather than two broken entities. After decoding, invisible characters like non-breaking spaces and zero-width characters are counted and can be cleaned up with one click. Everything runs in your browser.

## How to use

1. Choose Encode or Decode
2. When encoding, choose which characters to escape and how to write non-ASCII characters, and tick named entities if you like
3. Paste your text; the result updates live, then click Copy result
4. If the decoded result contains invisible characters, decide whether to replace them with normal spaces

## Features

- Escapes < > & " ', or only < > & if you prefer
- Non-ASCII characters kept as is, or written as decimal or hex numeric entities
- About 50 common symbols available as named entities, e.g. &copy; &euro; &nbsp; &mdash;
- Emoji and other supplementary characters encoded by full code point, never garbled
- Decodes every named and numeric entity, and flags non-breaking spaces, zero-width characters and soft hyphens
- Live conversion, runs locally, nothing uploaded

## FAQ

### Why escape, and which characters must be escaped?

A browser reads < as the start of a tag and & as the start of an entity, so to show text like <b> or Tom & Jerry you must write &lt;b&gt; and Tom &amp; Jerry. In element text, escaping < > & is enough. Inside attribute values (title="…", alt='…') quotes must be escaped too, or the attribute ends early, breaking the page and, at worst, letting someone inject a script. When unsure where the text will go, escaping all five is safest.

### Why is the apostrophe written &#39; and not &apos;?

&apos; comes from XML and was only officially added in HTML5; old HTML 4 and some older email clients do not recognize it. The numeric form &#39; works in every browser and email client, so this tool uses it. Both decode correctly.

### What is the difference between decimal, hex and named entities?

They all represent the same character and render identically. For 中, decimal is &#20013; and hex is &#x4E2D; (matching the Unicode code point U+4E2D), or you can keep the character itself. Only common symbols have names, e.g. © is &copy;, € is &euro; and the non-breaking space is &nbsp;, which are easier to read than numbers; HTML5 defines over two thousand names, but CJK characters have none. Almost every page today is UTF-8, so you can write such characters directly; numeric entities are only needed when the page encoding is uncertain or the output must be pure ASCII.

### How much bigger does text get with numeric entities?

In UTF-8 a Chinese character takes 3 bytes, but &#20013; takes 8, about 2.7 times as much; 😀 takes 4 bytes, while &#128512; takes 9. So converting all non-ASCII text to entities is not recommended unless you need it.

### Why did emoji used to turn into garbage when encoded?

Emoji like 😀 occupy two code units (a surrogate pair) inside JavaScript. Converting unit by unit produces two entities, &#55357;&#56832;, neither of which is a valid character on its own, so the browser shows �� and the emoji is lost. The correct approach is to encode the whole character as one entity, &#128512; (hex &#x1F600;), which is what this tool does; all three output styles decode back to the original in testing.

### What are the non-breaking spaces and zero-width characters it warns about?

&nbsp; decodes to a non-breaking space (U+00A0), which looks like a normal space but is a different character, so after pasting into code, Excel or a database, comparisons fail and searches miss. Zero-width characters such as &#8203; are completely invisible yet make identical-looking strings differ, and &shy; is a soft hyphen that only appears at a line break. The tool counts them after decoding, and Use normal spaces and remove invisible characters cleans the result without touching your input.

### Is this the right escaping for JavaScript or URLs?

No. HTML entities only apply to HTML text and attributes. Inside a JavaScript string you need escapes like \" \n \u4E2D, which String Escape / Unescape handles; in URL parameters you need percent-encoding such as %E4%B8%AD, which URL Encode/Decode handles; to look up a character's code point, use Unicode Converter. HTML entities have no effect inside <script>.

### Can decoding run scripts in the text?

No. Decoded content is parsed purely as text: &lt;img src=x onerror=alert(1)&gt; decodes to a string of characters and never loads an image or runs code.

### Are my files or data uploaded?

No. Everything runs locally in your browser with no network upload, and is discarded when you close the page.

### Do I need to sign up or pay?

No. The site is completely free, needs no account and has no usage limits.

## Related tools

- [JSON Formatter](https://qilingtools.com/en/json): Free online JSON formatter: beautify or minify, validate with the exact line and column of any error, browse a collapsible tree, sort keys and escape strings.
- [Base64 Encode/Decode](https://qilingtools.com/en/base64): Free online Base64 encoder and decoder: convert text, images and any file to Base64, and Base64 back to text or files. UTF-8 and GBK text, data URIs and URL-safe Base64; decoded images are previewed and downloadable. Processed locally, never uploaded.
- [URL Encode/Decode](https://qilingtools.com/en/url-encode): Free online URL encoder and decoder: turn spaces, symbols and non-English text into percent-encoding such as %E4%BD%A0, or turn encoded links back into readable text. Handles single values or whole URLs, UTF-8 and GBK, and + as space. Real-time and local, no upload.
- [JWT Decoder](https://qilingtools.com/en/jwt): Free JWT decoder: read the header and payload, check expiry, and verify the signature with a secret, PEM, JWK or JWKS. Runs locally, nothing uploaded.
- [Timestamp Converter](https://qilingtools.com/en/timestamp): Free online Unix timestamp converter: convert timestamps and dates, auto-detect seconds or milliseconds, and show local, UTC, ISO 8601 and relative time.
- [Hash / Checksum](https://qilingtools.com/en/hash): Free hash calculator: MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of text or files, with automatic comparison against a published checksum. Multi-GB files, no upload.
- [UUID Generator](https://qilingtools.com/en/uuid): Free online UUID generator: create UUID v4 (GUID) or time-ordered v7 in bulk with your browser's cryptographic RNG. Uppercase, no-hyphen and brace options, up to 100 at a time, one-click copy, generated locally.
- [Base Converter](https://qilingtools.com/en/base-convert): Free number base converter for binary, octal, decimal, hex and any base 2–36. Detects 0x/0b/0o prefixes and separators, with exact results for huge integers.