HTML Entity Encoder & Decoder

What is an HTML entity?

An HTML entity is a stand-in for a character, written so the browser stores the character without treating it as markup. Every entity starts with & and ends with ;.

The problem it solves: HTML uses < to start a tag and & to start an entity. If your content genuinely contains those characters, the parser cannot tell your text apart from your markup.

Write this in a page:

<p>5 < 10</p>

and the browser sees < 10</p> as the start of a tag. Escape the comparison operator and the meaning is unambiguous:

<p>5 &lt; 10</p>

The page still displays 5 < 10. Only the source changed.

The five characters that matter

Long lists of entities exist, but only five characters can actually change how markup is parsed:

Order matters when escaping. & has to go first, otherwise escaping < to < and then escaping ampersands turns it into <. This tool handles all five in a single pass, so that ordering bug cannot occur.

How to encode or decode entities

1. Choose a direction Encode turns characters into references. Decode turns references back into characters.
2. Pick a reference style when encoding Named produces ©, decimal produces ©, hexadecimal produces ©. All three render identically.
3. Choose what to escape “Markup characters only” touches the five above and leaves accented letters as readable text. “Markup plus all non-ASCII” escapes anything above code point 127 as well, which is useful for systems stuck on a legacy character encoding.
4. Check the counters When encoding you see how many characters were replaced and how much the output grew. When decoding you see how many named, decimal and hex references were found and resolved.

Named vs numeric references

Both forms point at the same character. The difference is legibility versus universality.

Examples of the same character in all three styles

Named references only exist for a fixed vocabulary. Emoji, most CJK characters and rarer symbols have no name at all, which is why the encoder falls back to a numeric reference automatically whenever no name applies.

The hexadecimal form is the one to reach for when working from a Unicode chart: U+2014 becomes — with no arithmetic. The decimal form requires converting 2014 from hex to 8212 first.

Double encoding, and how to recognise it

Double encoding is the most common entity bug. It happens when a string that is already escaped gets escaped again — usually because both a template engine and application code decided to be careful.

Original:        <b>bold</b>
Escaped once:    &lt;b&gt;bold&lt;/b&gt;
Escaped twice:   &amp;lt;b&amp;gt;bold&amp;lt;/b&amp;gt;

On the page, a double-escaped string displays as the literal text <b>bold</b> — visible entity codes instead of either bold text or the tags. That symptom, entities showing up in rendered output, always points at one escape too many somewhere in the chain.

This page flags input that matches the pattern & followed by another entity name, and you can send the output back to the input to peel off one layer at a time until the text is clean.

Entities are not the same as URL encoding

Both replace characters, but they apply to different layers and use different syntax. Mixing them up produces broken links.

A URL inside an href attribute can need both, in this order: percent-encode the query values, then entity-escape the resulting string for the attribute. So ?a=1&b=2 is written href="?a=1&b=2" in the source. Use the URL Encoder & Decoder for the percent-encoding half.

Use cases

• Publishing code in an article. Any HTML example shown as text has to be escaped, or the browser renders it instead of displaying it.
• Reading an escaped API response. Feeds and CMS exports frequently return <p> where you expected markup. Decode to see the real content.
• Auditing what a sanitiser did. Compare input and output to confirm the five markup characters were handled and nothing extra was mangled.
• Fixing entities that leaked into visible text. Decode the affected string to identify how many escape layers were applied.
• Preparing content for a legacy pipeline. Escaping all non-ASCII characters as numeric references keeps text intact through systems that are not reliably UTF-8.
• Finding invisible characters. Encoding non-ASCII reveals a non-breaking space as   and a zero-width space as ​, both of which are invisible in an editor.

Privacy and a security caveat

Encoding and decoding are string operations performed in your browser; the text is not uploaded to convert it.