01
Keep ordinary text readable
Encoding starts with named references and basic text preserved: printable ASCII plus TAB, CR and LF. The six characters &, <, >, both quotes and the backtick are always encoded; non-ASCII is encoded too.
Encoding and escaping
HTML entity encoderwith one-pass decoding
with one-pass decoding
HTML entity encoder
Input
Result
Plain-text preview
Preview displays at most 20,000 UTF-16 units as text; markup is not executed.
Conversion stays in this browser; input is not uploaded.
Conversion options
Encoding preserves U+0020–U+007E plus TAB, CR and LF except &, <, >, both quotes and backtick. Disable preservation to encode everything. Decoding resolves one layer with HTML5 text or attribute rules; unknown references remain. Numeric invalid values and C1 follow HTML replacements.
Input: 1,048,576 UTF-16 units; output: 4,194,304 units. Empty input is valid. Pasting may normalize line endings.
Enter text or load an example. Empty input converts to empty output.
Reverse uses the fresh result as input and changes direction after confirmation. It is unavailable when the result exceeds the input limit.
The HTML entity encoder helps when a code example must display angle brackets or when a CMS value arrives as character references. Choose readable names or numeric HTML entities according to the receiving format.
An HTML entity decoder restores references without parsing a document. HTML escape changes the representation of characters; it does not decide whether a complete template, script or URL is safe.
Why use this HTML entity encoder?
Compare three representations
This HTML entity encoder offers named references, decimal numbers and uppercase hexadecimal numbers. A missing name falls back to hexadecimal, so symbols outside the named table can still be represented.
Read markup without running it
Decoded angle brackets remain visible text in the result and preview. A tag-shaped value never becomes a live page here, letting you inspect copied examples without creating document elements.
Choose the context before checking the result
02
Control refresh timing
Automatic mode waits 350 ms after edits. Turn it off to show Convert, or use Ctrl/Cmd+Enter. Input and option changes mark the previous result stale and disable export until conversion succeeds.
03
Review a replacement first
Example, Clear and Reverse show a preview before Apply. Undo restores the input, options and result together. Preview stops at 20,000 UTF-16 units without splitting surrogate pairs; export uses the full result.
Character references with explicit choices
HTML5 names
The complete HTML5 named-reference table includes symbols beyond the familiar & and <. Decimal and hexadecimal references are supported in the same decode input. Named HTML5 references may represent two code points together, such as fj becoming fj when all text is encoded.
Text or attribute context
The default is text context. Attribute context changes how legacy names without a semicolon are recognized, especially before an ASCII letter, digit or equals sign.
One layer per conversion
Decoding &lt; produces <, not a less-than sign. Unknown references remain unchanged. Each run resolves references in the input once.
Locate invalid source text
A raw NUL or isolated UTF-16 surrogate is rejected with a line and column. Numeric references to invalid code points follow HTML replacement rules instead of source-text validation.
Exact scope and conversion boundaries
- Preservation has a defined range
- Preserve basic text keeps U+0020–U+007E plus TAB, CR and LF, except &, <, >, single quote, double quote and backtick. Turn it off to encode every character. Existing ampersands are encoded again.
- HTML recovery rules apply
- Numeric references for zero, surrogates or values above U+10FFFF become U+FFFD. C1 numeric references use historical HTML replacements; an encoded raw C1 control may therefore decode differently.
- No recursive decoding
- Each run decodes one layer using the chosen text or attribute context. Some legacy names work without semicolons; recognition is context-dependent. Unknown references are retained. To decode another layer, copy the current result into the input and select Decode again. Reverse changes direction, so it does not perform a second decode by itself.
- Plain text is not sanitization
- No HTML document is parsed, rendered or sanitized. Entity conversion does not validate JavaScript, CSS, URLs or attribute placement, and it is not a complete XSS defense. XML entity rules are a separate task; this page uses HTML5 rules.
- Source text and editor limits
- Raw NUL and isolated UTF-16 surrogates fail in either direction. No Unicode normalization is performed. Pasting into the editor may normalize line endings before conversion.
- Full results within fixed limits
- Input is limited to 1,048,576 UTF-16 units and output to 4,194,304. Oversize output fails as a whole. Empty input is valid; there is no file import, network fetching or recursive mode.
HTML entity encoder questions
When should I encode HTML entities?
Use the HTML entity encoder when literal text such as <article> should be represented by character references. Match the escaping method to the destination context; this page handles characters, not complete document security.
What does unescape HTML mean?
It means replacing recognized character references with their characters: & becomes & and < becomes <. Here this happens once and the result remains plain text.
Does encoding HTML entities prevent XSS?
It can be one part of context-appropriate output escaping, but it is not a sanitizer or a general XSS guarantee. Script, style, URL and attribute contexts require their own handling.
What is the difference between named and numeric entities?
A name such as © identifies a character through the HTML table. Decimal © and hexadecimal © identify its code point. Named encoding uses hexadecimal when no suitable name exists.
Why is < still in the output?
The source may contain &lt;, which has two encoding layers. One decode returns <. Review that output before deliberately decoding it again; recursive decoding is not automatic.
Found an encoding edge case?
Try a short sample
Choose the HTML entity encoder format, inspect the plain-text result, and copy the complete value when it is current.