HTML Entity Encoder & Decoder

The five characters Minimal mode escapes

How edge cases decode

Common named entities

How to encode or decode HTML entities

1. Choose Encode or Decode. Pick the direction, then paste or type your text. The result updates as you type.
2. Pick the mode. To encode, Minimal escapes the five characters HTML needs, All non-ASCII (numeric) also writes every other character as &#xHEX;, and Named entities uses names such as é where they exist. To decode, choose Element text or Attribute value, which differ for names without a semicolon.
3. Check the messages. Decoding lists each problem with its position: a missing semicolon, an unknown name, or a number that became U+FFFD. If the text was escaped twice, press “Decode again”.
4. Copy the result. Use Copy to put the result on the clipboard. The result is plain text, so paste it into your code or template.

Frequently asked questions

Which characters must be escaped in HTML?

Escape & < > " and ' when you put untrusted text into element content or into a quoted attribute value. That is the rule in the OWASP Cross Site Scripting Prevention Cheat Sheet, and it is what Minimal mode does. Always quote attribute values: an unquoted value can be ended by a space or a slash, which escaping the five characters does not stop.

Is HTML escaping enough to prevent XSS?

Only for the places it is meant for: element content and quoted attribute values. It is not enough inside a script block, a style block, an event-handler attribute, a URL such as href="javascript:…" or an unquoted attribute, each of which needs its own encoding or a different approach. The safest habit is to let a templating framework escape by default and to set text with textContent rather than innerHTML.

What is the difference between &amp;, &#38; and &#x26;?

Nothing once the browser has parsed them: all three stand for the ampersand, U+0026. The first is the name, the second the decimal code point and the third the hexadecimal one. Names are easier to read; numbers work for every character, including the ones that have no name.

Why does the tool write the apostrophe as &#x27; and not &apos;?

&apos; exists in XML and in HTML5, but not in HTML 4, and some old parsers and email clients ignore it. The numeric form &#x27; works everywhere, and it is the form the OWASP guidance gives. A decoder understands both.

Do I need to encode non-ASCII characters like é or €?

Not if your page is served as UTF-8 (declare it with <meta charset="utf-8"> or the Content-Type header): the characters can be written as they are. Numeric or named references help when the text travels through something limited to ASCII, such as some email systems, or when you want an invisible character such as a no-break space to be visible in the source.

Why does “&amp” or “&copy 2026” decode without a semicolon?

For historical reasons the HTML standard keeps 106 names that browsers accept without the closing semicolon, such as &amp, &lt, &copy and &eacute. Longer names like &euro or &hellip need the semicolon. Decoding reports a missing semicolon but still decodes, as a browser does. Always write the semicolon when you encode.

Why does the result differ between Element text and Attribute value?

Inside an attribute value, a legacy name without a semicolon that is followed by a letter, digit or “=” is not decoded, so a link like href="?a=1&copy=2" keeps its query string. The same text between tags would turn &copy into ©. A name with its semicolon decodes everywhere.

What happens to &#0;, &#x110000; and &#xD800;?

The HTML standard replaces a null reference, a number above U+10FFFF and a surrogate half (U+D800 to U+DFFF) with U+FFFD, the replacement character, and the decoder lists each one. Numbers from 128 to 159 are read as Windows-1252 characters, so &#128; is €, as in every browser. Control characters and noncharacters are decoded but flagged.

Why is my text still full of &amp;lt; after decoding?

It was escaped twice: the first round turned < into &lt; and the second turned that & into &amp;, giving &amp;lt;. One round of decoding gives &lt; back. When the tool sees &amp; followed by a reference it offers “Decode again”.

Is my text sent anywhere?

No. Encoding and decoding run in your browser and nothing is uploaded or stored. The list of 2,231 names is a small file the page downloads from this site only when it is needed, for example when you decode text containing a name like &eacute;; your text is never part of that request. The result is shown in a text box as plain text, never as HTML.