HTML Entity Encoder
Escapes and unescapes HTML entities, with named, decimal and hexadecimal output.
Converts characters to HTML entities and back — `&`, `&`, `&` — with a choice of how much to escape. Decoding also applies the Windows-1252 remapping the HTML parsing specification requires, which is why `’` comes back as a curly apostrophe rather than a control character.
Only `&`, `<` and `>`. This is everything you need between two tags, and nothing more.
Text
Encoded
The five that XML defines
| Character | Named | Decimal | Hex |
|---|---|---|---|
| & | & | & | & |
| < | < | < | < |
| > | > | > | > |
| " | " | " | " |
| ' | ' | ' | ' |
These are the only named references XML has without a DTD. Everything else in an XML document must be numeric.
How to use it
Decide how much to escape
Text content escapes only `&`, `<` and `>` — everything you need between two tags. Attribute value adds the two quote characters. Everything non-ASCII is for a pipeline that cannot carry UTF-8, and expands Korean text about sevenfold.
Pick the notation
Named (`&`) reads best; decimal and hexadecimal are numeric and work in XML, which has only five named references without a DTD.
Or go the other way
Switch to Unescape and paste text full of entities. Anything the table does not recognise is listed and left exactly as written rather than being dropped.
Common questions
Why was one of my entities left as written?
HTML5 defines 2231 named references and the table here carries a curated subset — every Latin-1 character, the punctuation, Greek, the arrows and the common maths symbols. Anything outside that is listed by name in a note rather than silently dropped, which is the honest failure.
Does escaping entities protect against XSS?
It is the right escaping for text content and for a quoted attribute value, and it is not enough anywhere else — inside a `<script>` block, in a `javascript:` URL, in an unquoted attribute, or in a CSS context, entity escaping does nothing useful. Escaping has to match the context it lands in.
Why does `’` decode to an apostrophe?
Because the HTML parsing specification says code points 0x80–0x9F in a numeric reference are to be remapped to the Windows-1252 characters at those positions. Decoding them literally would give invisible C1 control characters, which is what a naive decoder produces from Word-pasted text.
Can I use ` ` in XML?
Not without a DTD that declares it. XML has exactly five predefined named references — `&` `<` `>` `"` `'` — and the table at the bottom of the page lists them. Everything else must be numeric.
Feed it from
HTML Beautifier & Minifier
Formats or minifies HTML, preserving inline elements and optionally collapsing whitespace.
URL Encoder & Decoder
Percent-encodes and decodes URLs and query values, with a component-versus-whole-URL mode.
String Escaper
Escapes and unescapes strings for JSON, JavaScript, SQL, shell, CSV and regular expressions.
JSON Formatter & Validator
Pretty-prints, minifies and validates JSON, pointing at the exact line and column of a syntax error.
Next
These accept what this tool produces, so the result can go straight in.
HTML Beautifier & Minifier
Formats or minifies HTML, preserving inline elements and optionally collapsing whitespace.
String Escaper
Escapes and unescapes strings for JSON, JavaScript, SQL, shell, CSV and regular expressions.
Unicode Inspector
Breaks text into codepoints with names, blocks, scripts and UTF-8/UTF-16 byte sequences.
URL Encoder & Decoder
Percent-encodes and decodes URLs and query values, with a component-versus-whole-URL mode.
Base64 Encoder & Decoder
Encodes and decodes Base64 and Base64URL for text or files, handling UTF-8 correctly.
curl to Code
Converts a curl command into fetch, axios, Python requests, Go, PHP or PowerShell.