HTML Entities
Type plain text on the left to get escaped HTML, or paste entity-encoded text on the right to read it. Choose minimal escaping, numeric entities for all non-ASCII, or named entities where they exist.
Click a character, name or number to copy it.
| Char | Named | Decimal | Hex | Description |
|---|
When to escape HTML
Five characters have special meaning in HTML: & starts an entity, < and > delimit tags, and " and ' close attribute values. Any text you insert into a page, and especially anything a user typed, should have these escaped, or the browser may treat it as markup. That is the Minimal mode, and it is all a UTF-8 page needs.
All non-ASCII also turns every character above code point 126 into a numeric entity like é. Use it when the text will pass through a system that mangles UTF-8, such as some email templates or legacy databases. Named uses readable names like é and © where they exist and numbers for everything else.
Decoding
The right-hand box decodes every named entity the HTML standard defines (over 2,000, including ones not in the reference table) plus decimal © and hex © numeric entities. Unknown names are left untouched and counted, so a typo like ©y; is easy to spot. Nothing is sent anywhere.
Questions
What is the difference between and a normal space?
A non-breaking space ( , U+00A0) looks like a space but stops the browser from wrapping the line there, and consecutive ones are not collapsed. Use it between a number and its unit, like 10 kg.
Should I use ' or '?
' is valid in HTML5 and XML but was not part of HTML 4, so older parsers may not recognise it. ' works everywhere, which is why this encoder uses it.
Do I need to escape quotes?
Only inside attribute values. In ordinary text between tags, quotes are safe. Untick “Escape quotes” if you only need text-safe output.
Is escaping enough to prevent XSS?
Escaping these five characters makes text safe inside HTML element content and quoted attributes. It is not enough inside <script> blocks, style attributes, or URLs like href="javascript:…", which need their own encoding or validation.