HTML entity encoder and decoder
HTML entities are codes like < for < that let a page show characters the browser would otherwise read as markup. Paste text to encode the characters HTML reserves, and optionally everything outside ASCII, or paste entities to decode them back.
Encoded HTML
<p>Fish & chips for ₹250 — "today" only, at Raj's</p>
- Characters replaced
- 8 of 53& ×1, < ×2, > ×2, " ×2, ' ×1
- Length
- 53 → 83 characters
- This output is safe as text between tags. Inside an attribute, also put the value in quotes; inside <script>, a style, an event handler such as onclick, or a URL, HTML entities aren't enough and that context needs its own encoding.
How does HTML entity encoding work?
A character reference starts with & and ends with a semicolon. HTML has three forms: a name from its named character references list (&), a decimal code point after &# (&), or a hex code point after &#x (&). All three mean the same character, and the HTML standard requires the closing semicolon.
Encoding replaces the characters that HTML would read as markup. & starts a reference and < starts a tag, so they must be encoded in text; >, " and ' are encoded too, so the same output also works inside a quoted text attribute such as title or alt. The apostrophe has three spellings: ' and ' work everywhere, and ' is in the HTML standard's named list but was not defined in HTML 4.01.
Characters outside ASCII don't need encoding on a modern page: the HTML standard requires documents to be encoded in UTF-8, so é, ₹ and emoji can be typed as they are. Numeric references help when text passes through a system that isn't UTF-8, or to make invisible characters such as the no-break space visible in the source. There is no named reference for ₹, so it is ₹ or ₹.
Encoding is for the HTML context only. OWASP's cross-site scripting cheat sheet uses this encoding for text placed in HTML, says attribute values should always be quoted, and says JavaScript, CSS and URL contexts need their own encoding. Decoding here covers the 148 common names in this page's table and every decimal and hex reference; anything else is left as typed and listed under the result.
Numeric references are read the way the HTML standard tells browsers to read them: numbers 128 to 159 are taken as Windows-1252 characters, so – is – and € is €. References to zero, to a surrogate or to a number past U+10FFFF are left as typed and flagged, because a browser would show the replacement character � for them.
& → & < → < > → > " → " ' → ' (or ' or ') any character → &#decimal; or &#xHEX; ₹ (U+20B9) → ₹ = ₹
What are the HTML entities for common characters?
| Character | Named | Decimal | Hex |
|---|---|---|---|
| & | & | & | & |
| < | < | < | < |
| > | > | > | > |
| " | " | " | " |
| ' | ' | ' | ' |
| (no-break space) | |   |   |
| © | © | © | © |
| ® | ® | ® | ® |
| ™ | ™ | ™ | ™ |
| € | € | € | € |
| £ | £ | £ | £ |
| ¥ | ¥ | ¥ | ¥ |
| ₹ | none | ₹ | ₹ |
| — | — | — | — |
| – | – | – | – |
| … | … | … | … |
| “ | “ | “ | “ |
| ” | ” | ” | ” |
| é | é | é | é |
| × | × | × | × |
| → | → | → | → |
How to encode or decode HTML entities
- 1Choose encode or decodeEncode turns text into something a page shows literally; decode turns <, ₹ and similar references back into characters.
- 2Paste your textPaste the text or HTML. The result updates as you type, and nothing is sent anywhere.
- 3Pick the optionsWhen encoding, choose how to write the apostrophe, whether to encode characters outside ASCII as decimal or hex references, and whether to use names such as ©.
- 4Copy the resultCopy the output. Any reference that couldn't be decoded is listed under it with the reason.
Frequently asked questions
What is the difference between ' and '?
Is there an HTML entity for the rupee sign (₹)?
Does encoding HTML entities prevent XSS?
Why does my page show an entity code where an ampersand should be?
Do I need to encode accented letters and emoji in HTML?
Sources
- WHATWG HTML Living Standard, §13.1.4 Character references (named, decimal, hex; the semicolon) (checked 20 Oct 2026)
- WHATWG HTML Living Standard, §13.5 Named character references (the full list; no rupee or INR) (checked 20 Oct 2026)
- WHATWG HTML Living Standard, numeric character reference end state (U+FFFD cases, the 0x80–0x9F table) (checked 20 Oct 2026)
- WHATWG HTML Living Standard, Specifying the document's character encoding (must be UTF-8) (checked 20 Oct 2026)
- W3C HTML 4.01, Character entity references (no apos) (checked 20 Oct 2026)
- OWASP Cross Site Scripting Prevention Cheat Sheet (HTML, attribute, JavaScript and URL contexts) (checked 20 Oct 2026)
Need a custom dev tool for your team?
We build internal tools, dashboards, APIs, and SaaS platforms. If you can describe it, we can ship it.
Built by CountryDevs · No signup · No ads · We count visits, never what you enter