HTML Entity Encode/Decode

Encode or decode HTML entities using named, decimal or hex forms, including the full HTML5 entity set.

This tool runs entirely in your browser. Your data is never uploaded, never stored, and never leaves your device.

Encodes either the five markup-significant characters or all non-ASCII Unicode using common named entities with decimal fallback, all-decimal, or hexadecimal output; decoding understands the browser's complete HTML5 named and numeric entity set.

How to use it

1Choose Encode or Decode; encoding also lets you choose markup-only or all non-ASCII characters.
2Choose common named with decimal fallback, all-decimal, or hexadecimal output, then paste into the input box for an instant local result.
3Copy the output, clear the input, or swap the result into the opposite direction.

Example

Input: <a href="/x?a=1&b=2">Ben & Jerry’s — café</a>
Output: <a href="/x?a=1&b=2">Ben & Jerry’s — café</a>

In markup-only mode the curly apostrophe, em dash and é stay as characters. In all-Unicode mode they are encoded too, with astral characters such as emoji handled as one code point. Encoding text is not the same as sanitising untrusted HTML.

What happens to your data

This tool runs entirely in your browser. Your input is never uploaded to a server, never stored, and never logged. Encoding walks Unicode code points and applies the selected named, decimal or hexadecimal rule; decoding assigns the string to a detached textarea and reads its text value, borrowing the browser's complete HTML entity table without inserting the result into the page. A decoded <img src=x onerror=…> therefore lands in the output box as characters and is never run.

Last updated September 2026

A code sample pasted into a blog post shows a gap where the tags should be, because the browser read them as markup and drew them. A CSV export opens with &#39; scattered through every surname carrying an apostrophe. A comment box on a site you maintain turns out to render whatever anyone types into it. Those are one problem seen from three sides: text and markup share a character set, and nothing in the characters says which is which.

Work out which direction you need before you paste anything. Escaping takes text on its way into an HTML document and neutralises the characters a parser would otherwise read as structure. Unescaping takes text that has already been through that — lifted from page source, a log line, an API response, a column somebody encoded on the way in — and returns the characters a person actually typed.

The bigger decision is whether hand-escaping is the right answer at all. Doing it once, by hand, suits a snippet going into a template, a documentation example, or a message that has to show markup rather than run it. It is the wrong answer for anything a user can type, where escaping belongs in your template engine, at output time, on every field.

The mistake that costs the most time is escaping the same text twice. Nothing in a second pass can tell that the ampersand in front of it was already part of an entity, so & becomes &amp; and the page shows the entity instead of the character.

How it works

Toolvore handles the two directions with different mechanisms. Encoding walks Unicode code points and always escapes the five markup-significant characters; you can also include every non-ASCII character and choose a curated set of common readable names with decimal fallback, all-decimal references or hexadecimal references. It does not claim to emit every named alias in HTML5. The code-point walk keeps an emoji intact rather than splitting its surrogate halves. Decoding uses the browser's complete HTML5 entity table through a detached textarea, so decoded markup is returned as text and never inserted into the page. Both directions update locally as you type, and Swap deliberately moves the result into the opposite direction. Entity encoding is not a general HTML sanitiser because page text, attributes, URLs and script blocks have different safety rules.

Common use cases

Pasting a code sample into a blog post so the tags show instead of running
Recovering apostrophes and dashes from an export full of numeric references
Preparing a value to sit inside a hand-written HTML attribute
Reading a log line where the payload was stored HTML-encoded
Checking what a template engine actually produced when output looks wrong
Putting an example of markup into a support ticket or an email

Frequently asked questions

Why does my page show &amp; instead of an ampersand?＋

Text has been escaped twice, and each pass encodes the ampersand at the front of whatever the previous one wrote. One layer gives you & where an ampersand was; two gives &amp;, which a browser resolves to the visible text &. The same fault reads as <p> showing up as words mid-paragraph. Look for two things encoding the same value — a form handler escaping on the way into the database and a template engine escaping again on the way out. Decoding the stored column is a patch; the fix is to store what people typed and escape once, at output.

What is the difference between ' and '?＋

They mean the same character. ' is defined in XML and in HTML5's named list, but it was absent from HTML 4.01, so older parsers leave it on the page as literal text. The numeric reference ' carries no such history and is resolved everywhere, which is why encoders reach for it. The apostrophe is on the list at all because a single quotation mark can delimit an attribute value, and an unescaped one inside a value quoted that way closes it early — the opening an injected attribute needs. In ordinary page text an apostrophe needs no encoding.

If my page is UTF-8, do I still need entities for accented characters?＋

For display, no. Serve the document as UTF-8, declare the character set early in the head, save the file in the same encoding, and an accented letter, a copyright sign or an em dash can sit in the source as itself. Named references for those survive from a time when the transport could not be trusted to carry the bytes. Where they still earn a place is with characters that look like nothing: a non-breaking space, a soft hyphen, a zero-width joiner. Written as an entity, the next person reading your source can see what is there; written raw, it is an invisible byte.

Why does my text show Ã© and â€™ instead of accents?＋

That is an encoding mismatch rather than an entity problem, and escaping will not touch it. The bytes were written as UTF-8 and read back as Windows-1252 or Latin-1, so one character became two. Once it has been saved in that state the wrong characters genuinely are the characters now, and decoding entities cannot recover them. Check, in order: the charset in the response header, the meta tag, the encoding your editor saved with, and the collation of the database column and connection. Fix the declaration first, or you will repair the stored text and watch it break again.

Is escaping those five characters enough to prevent XSS?＋

In element text and inside a quoted attribute, yes. In three other places, no. An unquoted attribute can be escaped from with a space, a tab, a newline or a backtick, none of which are on that list. Inside a script block the parser is JavaScript rather than HTML, so JavaScript escaping is what applies. A URL-valued attribute such as href passes javascript: through HTML escaping untouched, so the scheme has to be checked separately. Escaping is per context, which is why template engines encode by destination rather than applying one function everywhere.

What is   and why does it keep appearing in my content?＋

It is U+00A0, a space that does not allow a line break and does not collapse into its neighbours the way an ordinary space does. Most of the ones people find were never typed: word processors and rich-text editors insert them when pasting. The trouble comes later. A run of text joined by them will not wrap, so it overflows its container on a narrow screen, and code that trims whitespace or splits on a space often fails to match it, because it is not the character the pattern expects. Decoded, it looks exactly like a space.

Are HTML entities the same as escaping for XML or JSON?＋

No, and mixing them up breaks feeds. XML predefines five references only — lt, gt, amp, quot and apos — so   in an XML document is an undefined entity and a parser rejects the file rather than guessing. That is why HTML pasted into an RSS item or an XML API can fail on a character that was fine on the page. JSON has no entities at all: it escapes with backslashes, and a code point that needs it is written as a backslash-u sequence. An HTML entity inside a JSON string is ordinary text, still needing decoding after the parse.

Does anything I paste here get sent to a server?＋

No. The component runs in the browser with no network call of any kind in it: your text is held in the page's own state, the result is computed from it directly, and closing the tab is the whole of the cleanup. Nothing is written to storage, there is no account and no history, and no file is involved in either direction — you paste, and you copy. Nothing caps how much you paste, though a very large block is re-processed on every keystroke. This matters because encoded values are usually lifted from production logs and live database columns.