Skip to content

HTML entity encoder & decoder

Escape <, >, & and quotes so text shows safely in a web page, or turn &amp;-style entities back into characters.

Favorite
Runs in your browser. Nothing you paste is sent anywhere.

How it works

& → &amp; < → &lt;

In HTML, < starts a tag and & starts an entity, so to show those characters as text you write them as entities: &lt; and &amp;. Inside attributes, quotes need the same treatment. Any character can also be written by number, as &#233; (decimal) or &#xE9; (hex), and many have names, like &eacute; or &copy;.

  1. Always escape these five & → &amp; < → &lt; > → &gt; " → &quot; ' → &#39;
  2. Any character by number é = U+00E9 = 233 → &#233; or &#xE9;
  3. Escape & first when doing it by hand &lt; → &amp;lt; (not &lt;)

Common entities

Character Name Number
& &amp; &#38;
< &lt; &#60;
> &gt; &#62;
" &quot; &#34;
' &apos; &#39;
no-break space &nbsp; &#160;
© &copy; &#169;
® &reg; &#174;
™ &trade; &#8482;
€ &euro; &#8364;
° &deg; &#176;
× &times; &#215;
— &mdash; &#8212;
… &hellip; &#8230;

Good to know

  • Escaping what users type before showing it is the main defense against cross-site scripting (XSS).
  • PHP’s htmlspecialchars() and the default setting here escape the same five characters.