HTML entity encoder and decoder
Escape text for HTML with named, decimal or hex entities, or turn entities such as & and é back into characters.
Code examples
Copy and paste these into your own project. Each one uses only the language's standard library, so there is nothing to install.
const text = '<p class="x">Tom & Jerry</p>'
const entities = { '&': '&', '<': '<', '>': '>', '"': '"', "'": ''' }
console.log(text.replace(/[&<>"']/g, (char) => entities[char]))What it does
Escapes text for HTML, and turns HTML entities back into characters. An entity writes a character by name (é), as a decimal number (é) or as a hex number (é).
How to use it
- Type or paste text, or drop a text file.
- Pick Encode or Decode. When encoding, choose whether to escape only the characters HTML reads as markup or every non-ASCII character too, and whether to write names, decimal numbers or hex numbers.
- Copy or download the result.
Examples
Escaping markup:
<p class="x">Tom & Jerry</p> becomes <p class="x">Tom & Jerry</p>. With every non-ASCII character escaped, café © € becomes café © €.
Good to know
- The characters that always need escaping in HTML text and attributes are
&,<,>,"and'. - The apostrophe is written
', because HTML 4 has no name for it. Decoding also reads'. - Characters with no name, such as emoji, are written as numbers, one number per character.
- The table of names covers the 252 entities of HTML 4.01. A name outside it is left as typed when decoding.
What is an HTML entity?
An entity is a way to write a character in HTML without typing it: a name such as é, or a number such as é (decimal) or é (hex). Five characters must be escaped in text and attributes because HTML reads them as markup: & < > and the two quote marks.
Frequently asked questions
Which characters must I escape?
Escape & and < in text, and the quote mark that surrounds an attribute value inside it. Escaping > and both quote marks everywhere is harmless and the safe default, which is what Markup only does. Escaping user input this way is the first defence against injected markup.
Why does the apostrophe become ' and not a name?
HTML 4 has no named entity for the apostrophe. ' exists in XML and HTML5 but older software does not know it, so a number is the safe choice. Decoding accepts both.
Does this tool send my text anywhere?
No. Everything happens in your browser. What you type is never sent to our servers.