Skip to content
DevTools

HTML Entity Encoder

text ⇄ entities

Escape text so it is safe inside HTML, or decode entities back.

Escapes & < > " ' plus punctuation that has a named entity. Accents and emoji stay as themselves.
plain text
encoded
Result appears here

About HTML Entity Encoder

Escape text so a browser renders it as text rather than parsing it as markup, or decode entities back into the characters they stand for. The five that matter are the ampersand, both angle brackets, and both kinds of quote; escaping them is what stops user-supplied text from becoming a tag.

Two levels are offered. The default escapes only what markup requires, plus the punctuation that has a familiar named entity — so accents and emoji pass through as themselves, which is correct for any modern UTF-8 page. The stricter mode escapes every non-ASCII character numerically as well, for the older systems and email templates that still cannot be trusted with anything above ASCII.

Decoding accepts named entities and numeric ones in both decimal and hex, and leaves anything it does not recognise alone — so a literal "&foo;" in your prose survives a round trip rather than quietly disappearing.

Common questions

Does escaping HTML protect me from XSS?
In the right place, yes — escaping text before it lands in an HTML body is exactly the defence. But context decides: text going into an attribute, a URL, a style block, or inline JavaScript each needs different escaping, and HTML entities are not sufficient for those. Prefer your framework's own escaping over a manual pass.
Do I need to escape accents and emoji?
No, as long as your page declares UTF-8, which any modern one does. Escaping them makes the source larger and much harder to read for no benefit. The strict mode exists for legacy transports, not for web pages.
What is the difference between &#39; and &apos;?
Both mean an apostrophe. &#39; is the numeric form and works everywhere including very old HTML; &apos; is defined in XML and HTML5 but was absent from HTML4. Encoding here emits the numeric form for safety, while decoding accepts either.
Why does a non-breaking space look like an ordinary space?
Because it is invisible by design — it prevents a line break rather than looking different. It shows up here as &nbsp; in the encoded output, which is often how people discover one has been pasted in where a normal space was intended.

This page does the work itself, in this tab. Nothing you paste is sent to a server. Close the tab and no copy remains.