🔧 Developer Tools

HTML Entity Encoder & Decoder

Encode special characters to HTML entities, decode them back, or unescape JavaScript string literals. Includes a searchable reference table of 150+ named HTML entities.

Encode & decode HTML entities Named vs numeric output JS string unescape mode 150+ entity reference table

AdSense — 728×90 Leaderboard

Output format:

Named (&) Decimal (&) Hex (&)

Encode:

Minimal (<>&"') All non-ASCII

Input text

Encoded output

AdSense — 728×90 Leaderboard

📝

Converting Markdown to HTML first?

Use the free Markdown to HTML Converter to generate your HTML, then run it through this encoder to escape any special characters for safe embedding in code or templates.

Markdown to HTML →

⭐ Ratings

Rate this tool

4.8

★★★★★

Based on 12,840 ratings

11,042

1,027

385

257

128

Did this save you time encoding HTML?

Thank you for the feedback!

Features

Three modes, three output formats, and 150+ searchable entities

Most HTML entity encoders offer a single encode function with no reference table and no format choice. This tool provides three distinct modes — Encode, Decode and JS Unescape — with three output formats (named, decimal, hex) and a searchable reference table of 150+ named HTML entities you can click to copy directly.

Encode HTML entities

Convert special characters (< > & " ') to HTML entities. Choose minimal encoding (just the five critical characters) or all non-ASCII characters for maximum safety.

Decode HTML entities

Convert HTML entities back to their original characters. Handles named entities (&), decimal numeric references (&) and hex references (&) in one pass.

JS string unescape

Decode JavaScript escape sequences: \n (newline), \t (tab), \r (carriage return), \\ (backslash), \' and \" (quotes), and \uXXXX Unicode escapes. Unique to this tool.

Named, decimal or hex output

Switch output between named entities (&), decimal numeric references (&) and hexadecimal references (&). All produce identical results in any browser.

Searchable entity reference

150+ named HTML entities in a searchable grid. Search by character, name or category. Click any entity card to copy its named, decimal or hex value directly to clipboard.

Swap, copy and clear

Swap input and output to quickly re-encode or re-decode. Copy output with one click. Clear button resets both fields. Char count shown in the status bar.

How to use

How to encode and decode HTML entities

Choose a mode

Select Encode to convert characters to HTML entities, Decode to convert entities back to characters, JS Unescape to process JavaScript escape sequences, or Entity Reference to browse the full entity table.

Set your options

For encoding, choose Named, Decimal or Hex output format. Choose Minimal to only encode the five critical HTML characters, or All non-ASCII to encode every character above U+007F.

Paste your text and process

Paste or type text in the input box, then click the arrow button or the Encode/Decode button. The output appears immediately in the right panel. The status bar shows character and entity counts.

Copy or browse the entity table

Click Copy output to copy the result to your clipboard. Or switch to Entity Reference to browse 150+ named entities, search by name or character, and click any card to copy that entity.

Comparison

LazyTools vs other HTML entity encoders

Feature	⭐ LazyTools	htmlentities.org	codebeautify.org	onlinestringtools.com
Encode HTML entities	✔	✔	✔	✔
Decode HTML entities	✔	✔	✔	✔
JS string unescape	✔	✘	Partial	✘
Named / decimal / hex output	All 3	Named only	2 formats	Named only
Minimal vs all-non-ASCII scope	✔	✘	✘	✘
Searchable entity reference table	150+ entities	✘	✘	✘
No ads	✔	⚠ Ads	⚠ Ads	⚠ Ads
No login required	✔	✔	✔	✔

Quick reference

The five critical HTML characters

These five characters must always be encoded in HTML content. Failing to encode them causes broken markup, rendering errors or XSS vulnerabilities.

Char	Name	Named entity	Decimal	Hex	Why encode?
&	Ampersand	&	&	&	Starts all entity references. Raw & in text breaks entity parsing.
<	Less-than	<	<	<	Opens HTML tags. Raw < in text is interpreted as a tag start.
>	Greater-than	>	>	>	Closes HTML tags. Less critical but required for valid markup.
"	Double quote	"	"	"	Terminates double-quoted attribute values. Must encode inside attributes.
'	Single quote	' / '	'	'	Terminates single-quoted attribute values. Must encode inside attributes.

Complete guide

HTML Entity Encoder and Decoder — Complete Guide

HTML entities are a way to represent characters in HTML that either have special meaning in the markup language or cannot be typed directly in ASCII. An entity consists of an ampersand, a name or number, and a semicolon: & represents the ampersand character itself, < represents the less-than sign, and © represents the copyright symbol. Understanding when and how to encode HTML entities is fundamental to writing secure, valid web pages.

HTML entity encoder decoder online free

An online HTML entity encoder converts plain text containing special characters into their HTML entity equivalents. The five characters that must always be encoded in HTML body content are the ampersand (&), less-than sign (<), greater-than sign (>), double quote ("), and single quote ('). In attribute values, the quote characters are especially important because they terminate the attribute string. Failing to encode these characters can produce broken markup, unexpected rendering or, in dynamic web applications, cross-site scripting (XSS) vulnerabilities where user input containing <script> tags is interpreted as HTML.

Escape special characters HTML online

When user-generated content is inserted into an HTML page without encoding, an attacker can inject script tags or event handler attributes. The minimal safe encoding strategy is to encode all five critical characters before placing any string into HTML content or attributes. For maximum safety in multilingual content — particularly when the page encoding may be uncertain — all characters above U+007F (non-ASCII) can also be encoded as numeric references. This is the All non-ASCII mode in this encoder, which produces output that is safe in any character encoding environment.

HTML entities reference table with encoder

Named HTML entities cover a wide range of characters beyond the five critical ones. Common ones include: © (copyright symbol ©), ® (registered trademark ®), ™ (trademark ™), € (euro sign €), £ (pound sign £), ¥ (yen sign ¥), — (em dash —), – (en dash –),   (non-breaking space), « and » (French quotation marks « »). The Entity Reference tab in this tool provides a searchable grid of 150+ named entities you can copy in any format.

HTML unescape online free

HTML decoding (unescaping) converts encoded entities back to their original characters. This is necessary when reading HTML source code that contains encoded content, when processing HTML stored in a database or CMS, or when working with content from an API that returns HTML-encoded strings. The decoder handles all three entity formats: named entities (& → &), decimal numeric references (& → &), and hexadecimal references (& → &). Malformed entities (missing semicolons or unknown names) are passed through unchanged.

JavaScript string escape tool

JavaScript string literals use backslash escape sequences rather than HTML entities. The most common are \n (newline character, U+000A), \t (horizontal tab, U+0009), \r (carriage return, U+000D), \\ (literal backslash), \' (single quote), \" (double quote), and \uXXXX (Unicode escape for any character by its four-hex-digit code point). The JS Unescape mode in this tool converts these escape sequences to their actual characters. This is useful when dealing with JSON strings that have been serialised with escape sequences, log files, database content or API responses that contain JavaScript-encoded text.

XML entity encoder

XML uses the same five critical entity references as HTML: &, <, >, " and '. Unlike HTML, XML does not have named entities beyond these five — all other characters must be represented as numeric references (© for copyright, etc.) or as actual Unicode characters in a UTF-8 encoded document. The Minimal encoding mode in this encoder produces output valid for both HTML and XML. When targeting XML specifically, use the Named format option and ensure your XML document declares UTF-8 encoding in the XML declaration.

Frequently asked questions

What is an HTML entity?▼

An HTML entity is a string that begins with an ampersand and ends with a semicolon, representing a character that either has special meaning in HTML or is difficult to type. Named entities use a descriptive name: & for ampersand, © for copyright. Numeric entities use the character's Unicode code point in decimal (©) or hexadecimal (©) form. All three notations produce identical results in any browser.

When do I need to encode HTML entities?▼

You need to encode HTML entities whenever you insert dynamic or user-supplied text into an HTML document. The five critical characters (& < > " ') must always be encoded in HTML body content and attribute values respectively. If you skip encoding, your page may break visually when the text contains angle brackets, or create security vulnerabilities when user input contains script tags or event attributes. Most server-side frameworks (Django, Rails, Laravel, React JSX) auto-encode output by default, but raw string concatenation into HTML requires manual encoding.

What is the difference between named and numeric entities?▼

Named entities use a human-readable name: &, <, ©, €. Numeric entities use the character's Unicode code point in decimal (&, ©) or hex (&, ©). Named entities are more readable but require the browser to have a lookup table for the name. Numeric entities work for every character in Unicode, even those without named equivalents. Both produce identical rendered output. XML only supports the five named entities (&, <, >, ", ') and requires numeric references for everything else.

What is   and when should I use it?▼

  is the non-breaking space entity (U+00A0). Unlike a regular space, a non-breaking space prevents the browser from inserting a line break at that position. Use it to keep words together that should not be separated across lines (e.g. "100 km", "Mr. Smith", a value and its unit). Do not use it to add visual spacing or indentation — use CSS margin and padding for that. Overusing   is a common mistake that makes HTML harder to maintain.

How do I encode a string in Python or JavaScript?▼

In Python: use html.escape(string) from the html module. It encodes &, <, >, and " by default. Pass quote=True (the default since Python 3.2) to also encode single quotes. To decode: use html.unescape(string). In JavaScript: there is no built-in HTML encode function. The standard pattern is to set a text node's nodeValue and read back the parent HTML, or to use a library like he or DOMParser. For server-side Node.js, the entities npm package or similar. React automatically encodes JSX content so direct string encoding is rarely needed in React apps.

What JavaScript escape sequences does the JS Unescape mode handle?▼

The JS Unescape mode handles: \n (newline, U+000A), \t (tab, U+0009), \r (carriage return, U+000D), \0 (null character), \b (backspace), \f (form feed), \v (vertical tab), \\ (literal backslash), \' (single quote), \" (double quote), \uXXXX (four-hex-digit Unicode escape for Basic Multilingual Plane characters), and \xXX (two-hex-digit Latin-1 escape). Unrecognised escape sequences are passed through unchanged with the backslash preserved.

Does HTML encoding prevent XSS attacks?▼

HTML encoding of the five critical characters (& < > " ') is the primary defence against reflected and stored XSS in HTML context. When an attacker tries to inject <script>alert(1)</script>, encoding converts it to <script> which the browser renders as visible text, not executable code. However, encoding alone is not sufficient for all contexts. In JavaScript strings, you need JavaScript escaping. In URLs, you need percent-encoding. In CSS values, different rules apply. OWASP calls this context-sensitive output encoding: you must use the right encoding for the context where the data is being placed.

What is the ' entity and why does it sometimes not work?▼

' (apostrophe / single quote) was defined in XML 1.0 and adopted by HTML5, but was not part of the original HTML 4.01 specification. Older browsers and some HTML 4.01 parsers do not recognise ' as a valid named entity. For maximum compatibility, use the numeric reference ' (decimal) or ' (hex) when encoding single quotes in HTML. These numeric forms work in all browsers and HTML versions. In XHTML and XML, ' is valid and preferred because it is one of the five built-in XML entities.

Related tools