HTML Entity Encoder and Decoder Online
Encode text as HTML entities or decode entity references into characters. Select the mode that matches the markup context you are inspecting.
HTML Entity Encoder & Decoder workspace
Try a Sample
Bidirectional in One Click
Encode plain text to entities, decode entities back to characters. Toggle direction without losing your input. No copy-paste round-tripping.
XSS-Safe Encoding
"Dangerous Five" mode encodes only `& < > " '` — the minimum-required set to safely embed user content in HTML body and attribute contexts. No data loss, no overzealous mangling.
Full Unicode
Surrogate-pair safe, emoji safe. Iteration is per code point (not per UTF-16 code unit), so `👋` encodes as a single `👋` entity, not as two broken halves.
100% Client-Side
Encoding, decoding, and entity-table lookup all run in your browser. User submissions, leaked credentials, or pre-sanitized payloads — none of it leaves your device.
HTML Entity Converter: encode and decode HTML entities online
Encode text as HTML entities or decode entity references into characters. Select the mode that matches the markup context you are inspecting. Entity encoding is context-dependent. Escaping text for an HTML element does not make it safe in a JavaScript string, CSS value, or URL. Use the destination framework's normal escaping and validation rules when rendering untrusted data.
How to use the HTML entity converter
- Pick a direction with the toggle: Encode → Entities for plain text, or Decode → Plain Text for entity-laden HTML.
- For encoding, choose a Mode: Dangerous Five Only, Named (with numeric fallback), Numeric (always), or All Non-ASCII.
- For numeric output, set the Numeric format to Decimal (
') or Hexadecimal ('). - Paste or type into the input box, or click a sample (XSS payload, Mixed Unicode, encoded source, Math + Greek). Output updates instantly.
- Use Copy to grab the result, the flip button to round-trip it through the other direction, or Clear to reset.
What are HTML entities and how do they work?
An HTML entity is a placeholder that represents a character the parser would otherwise treat as structure. Every entity starts with an ampersand and ends with a semicolon. There are three forms: named(©), decimal numeric (©), and hexadecimal numeric(©) — all three produce the same © character. The complete list of named references lives in the WHATWG HTML Standard, section 13.5, which defines roughly 2,231 names — far more than the ~150 common ones this tool curates.
Only five entities are strictly required. XML predefines exactly &, <, >, ", and ', and the trailing semicolon is mandatory. These are the characters that delimit markup, so leaving them literal lets a browser read injected <script> tags or attribute breaks as real HTML — the mechanism behind stored and reflected XSS. Numeric references work for every Unicode code point up to U+10FFFF, including emoji, which is why numeric mode never runs out of coverage.
"XML specifies five predefined entities:&,<,>,', and"."— List of XML and HTML character entity references
The five required HTML entities
| Character | Named Entity | Decimal | Hex | Why It's Required |
|---|---|---|---|---|
| & | & | & | & | Starts every other entity — must be encoded first |
| < | < | < | < | Starts a tag — un-encoded enables tag injection |
| > | > | > | > | Closes a tag — pairs with < for full injection |
| " | " | " | " | Breaks out of double-quoted attribute values |
| ' | ' | ' | ' | Breaks out of single-quoted attribute values |
Worked examples: input → output
Encode · dangerous-five mode
<script>alert("hi")</script> → <script>alert("hi")</script>
Encode · named mode
Crème Brûlée & €5.99 → Crème Brûlée & €5.99
Decode · mixed named + numeric input
<p>Hi & bye</p> © €19 → <p>Hi & bye</p> © €19
Edge case · emoji & unknown entity
Encoding a rocket emoji in numeric mode yields a single 🚀 (code point U+1F680), not two broken surrogate halves — because the encoder iterates with for...of. On decode, an unknown name like ¬areal; is left unchanged and flagged in the stats footer rather than silently dropped.
Where HTML entities fit: context-aware encoding
HTML entities solve the HTML context only. Each output context has its own escape rule, and using the wrong one leaves a hole:
| Output context | Correct escaping | Example |
|---|---|---|
| HTML body / attribute | HTML-encode the dangerous five (this tool) | <script> |
| URL path / query string | Percent-encode via the URL Encoder | %3Cscript%3E |
| JavaScript string literal | JSON-encode, then HTML-encode if inside markup | "<script>" |
| CSS property value | CSS-escape: backslash + hex code point | \3C script\3E |
The ' trap most converters ignore
In dangerous-five mode this tool maps the apostrophe to the named entity '. That is valid in HTML5 and XML, but ' was not defined in HTML 4 or XHTML 1.0 — so it can render literally as the text ' in old parsers like Internet Explorer 8. If your output must survive legacy environments, switch to Numeric mode, which emits the universally safe ' instead.
A second real limit: the curated named table holds ~150 entries, not the full ~2,231 in the spec. In Namedmode, any character without a curated name (most CJK text, rare symbols) automatically falls back to a numeric reference, so you never get a broken or missing entity — just a numeric one. On decode, names outside the table pass through untouched and are reported, never silently lost.
Related developer & web utilities
Percent-encode the URL context
HTML FormatterPretty-print your encoded HTML
HTML to JSXConvert markup for React
JavaScript MinifierShrink scripts for production
CSS MinifierCompress stylesheets fast
Base64 EncoderFor JSON / HTTP-header contexts
Meta Tag PreviewerPreview your <head> tags
Open Graph GeneratorBuild OG social tags
Favicon GeneratorCreate site icon assets
Markdown TOCGenerate a table of contents
Word CounterCount words and characters
Guide: Open Graph Meta TagsEscape entities in OG tags correctly
All ToolsBrowse the full Toolk hub
Last updated: September 15, 2026 · Runs 100% in your browser — no uploads, tool input is not sent to Toolk.
Frequently asked questions
What is the difference between named and numeric entities?
Named entities use a readable label such as ©, while numeric entities carry the raw Unicode code point in decimal (©) or hex (©). All three spellings render the same character, but the named list holds roughly 2,231 labels whereas numeric references cover every Unicode character, emoji included.
Does encoding the dangerous five fully prevent XSS?
It is the foundation, not the whole defense. Escaping & < > " ' correctly protects HTML body text and attribute values, but JavaScript strings, URL parameters, and CSS contexts each need their own escaping rules, and rich-text pipelines need a vetted sanitizer such as DOMPurify on top.
How are emoji and other astral characters handled?
Correctly. The encoder walks the string by code point rather than by UTF-16 unit, so an emoji like the rocket (U+1F680) becomes one 🚀 reference instead of two broken surrogate halves. Decoding reverses the process losslessly in both directions.
Does my text stay on this device?
Yes — conversion runs locally in your browser tab, and Toolk’s page analytics do not receive the text you paste. Once loaded, the converter keeps working offline, so proprietary or unreleased content never touches a network.
When should I escape versus when should I leave markup intact?
Escape whenever untrusted data appears inside HTML you deliver — user comments, query-string echoes, email templates. If you are preparing code samples for display in a page, escaping is exactly what you want; try pairing it with Toolk’s HTML Formatter (/tools/html-formatter) to keep the surrounding markup tidy.