Free HTML Entity Encoder and Decoder
Escape text so it displays literally in HTML, or decode entities like & and — back to normal characters.
Why the ampersand has to be escaped first
The five-character escaping this tool performs isn't order-independent — the ampersand has to be replaced before any of the others. Escaping < to < introduces a literal & character into the output; if the ampersand pass ran after that, it would re-escape the entity it just created and turn < into the broken, doubly-escaped &lt;. Doing the ampersand first — before any entity exists in the output to accidentally catch — is what keeps every other substitution clean.
Named vs. numeric entities
An entity like — is a "named" entity — a mnemonic the browser has to specifically recognize. A numeric entity like — (decimal) or — (hexadecimal) instead references the character's Unicode code point directly, which works in any HTML parser regardless of which named entities it happens to support — useful when targeting older or less common rendering environments where a named entity might not be recognized.
Frequently Asked Questions
Which characters must be escaped in HTML?
The essential five: & (as &), < (<), > (>), " ("), and ' ('). The first three prevent text from being parsed as markup; the quotes matter inside attribute values.
When would I encode non-ASCII characters too?
Mostly for legacy systems, email HTML, or files that might be saved without UTF-8 encoding. Modern UTF-8 pages can include é, —, or emoji directly — encoding them is optional insurance.
Why does the ampersand need to be escaped before the other characters?
Escaping < or > first would insert a literal & into the output as part of < or > — if the ampersand pass ran afterward, it would re-escape that newly created entity into a broken, doubly-escaped sequence. Escaping & first avoids that entirely.
What's the difference between a named entity and a numeric one?
A named entity like — relies on the parser recognizing that specific mnemonic name. A numeric entity like — (decimal) or — (hex) references the Unicode code point directly, so it works consistently even in parsers with limited named-entity support.
Does the decoder handle named and numeric entities?
Both. Named entities (—), decimal (—), and hexadecimal (—) all decode using the browser's own HTML parser — the same one that renders web pages.
Does escaping protect against XSS?
Escaping user input before inserting it into HTML is a core XSS defense — but context matters: attribute values, URLs, and JavaScript strings each need their own escaping rules. For URLs, see our URL encoder.