Escape a text fragment
Tea & cake <today> becomes Tea & cake <today>. Quotes and apostrophes are escaped as well.
& → &< → <> → >" → "' → 'The output stays plain text, even when it contains tags. Decoding processes one layer of semicolon-terminated references using a detached parser that receives only validated entity tokens. Unknown names, missing semicolons, zero and invalid scalar references are errors. Limit: 250,000 UTF-16 code units.
Conversions run locally in your browser. This tool does not upload input or save it to browser storage.
How to use the HTML Entity Encoder & Decoder
- 01
Choose encode or decode.
- 02
When encoding, optionally convert non-ASCII code points into hexadecimal numeric references.
- 03
Paste text. For decoding, use complete references with semicolons; write a literal ampersand as &.
- 04
Copy or download the plain-text result. Reverse it to inspect one conversion layer.
Examples
Read an emoji reference
🍰 decodes to 🍰. With non-ASCII escaping enabled, that emoji becomes a single numeric reference for its code point.
Named references and numeric references
Names such as © come from the browser’s HTML character-reference table. Decimal references use numbers after &#, while hexadecimal references use &#x. One named reference can represent more than one Unicode code point.
Strict input, one decoding pass
This tool requires a terminating semicolon, rejects unknown names, and rejects zero, surrogate, or out-of-range numeric values. It decodes one layer: &lt; becomes <, not a less-than sign. Some legacy numeric values follow the browser’s HTML compatibility mappings.
Escaping has a context
The five basic escapes are useful for ordinary HTML text and quoted attributes. They are not a general sanitizer for JavaScript, CSS, unquoted attributes, or URL destinations. Handle those contexts with their own rules. The decoder never inserts the supplied fragment as HTML.
What to know
- 250,000 UTF-16 code units per input.
- Strict semicolon-terminated references only; numeric HTML compatibility mappings may differ from direct Unicode escapes.
Common questions
Can decoding execute a script tag?
No. The decoder sends only validated entity tokens to a detached template. The complete input is never parsed as markup, and the result is rendered as text.
Why is © without a semicolon rejected?
Browsers accept some historical omissions, but this tool uses a strict, explicit reference format to avoid ambiguous results. Enter ©.
Will all non-ASCII letters become named entities?
No. Optional non-ASCII encoding uses numeric code-point references. It does not search for a named alias for every character.