HTML entity encoder / decoder

<a href="x">Tom & Jerry’s</a>

What this HTML entity tool does

Encode takes plain text and escapes the five characters that have meaning in HTML — &, <, >, " and ' — into &, <, >, " and '. The result can be dropped into element content or an attribute and will display literally instead of being parsed as markup. Decode does the reverse for named entities, decimal (©) and hexadecimal (©) references. The logic is a pure string replace with no DOM involved, so it behaves the same everywhere and runs entirely in your browser.

How to use it

1. Pick Encode or Decode.
2. Paste into the input box. The sample <a href="x">Tom & Jerry’s</a> shows all the interesting characters at once.
3. The output updates as you type — notice the curly apostrophe ’ in the sample is not touched, because it has no special meaning in HTML.
4. Click Copy.

The five characters and their entities

Character	Named	Decimal	Hex	Why it is dangerous
&	&	&	&	Starts an entity — &copy 2024 can render as © 2024
<	&lt;	&#60;	&#x3C;	Opens a tag; <script> is the classic injection
>	&gt;	&#62;	&#x3E;	Closes a tag; escaped for symmetry and safety in attributes
"	&quot;	&#34;	&#x22;	Ends a double-quoted attribute value
'	&#39; (&apos; in HTML5)	&#39;	&#x27;	Ends a single-quoted attribute value

Encoding the sample input gives:

<a href="x">Tom & Jerry’s</a>

Strictly, only & and < must be escaped in text content, and only the matching quote inside an attribute. Escaping all five everywhere costs nothing and removes the need to remember which context you are in, which is what every templating engine (React, Vue, Jinja, Handlebars {{ }}) does by default.

Common named entities the decoder knows

Entity	Character	Entity	Character
 	non-breaking space	©	©
®	®	™	™
…	…	—	—
–	–	« »	« »
€	€	°	°

Anything else — é, →, ♥ — must be written numerically (é, →, ♥) to be decoded here. In practice, modern UTF-8 pages rarely need named entities beyond the five above and  ; you can type → and ♥ directly.

Decoding gotchas

• Double-escaped text. Content that was escaped twice (common when a CMS escapes on save and on render) shows < on the page. One decode pass turns it into <, a second into <. The tool decodes one level per run, so paste the output back in if you need both.
• Case matters for names. & is not a valid entity in HTML; the tool is lenient and decodes it, but browsers will not.
• Missing semicolon. &copy 2024 is not decoded — the decoder requires the closing ;. Browsers forgive some legacy names without it, which is exactly why unescaped & in URLs (?a=1&copy=2) can corrupt your links.
• Numeric zero (�) and out-of-range code points are left as-is rather than producing invalid characters.

Related tools and snippets

• URL encoder / decoder — the other escaping you need for links: & in an href needs both percent-encoding rules and &.
• JSON formatter & validator — JSON embedded in a <script> tag needs < escaped as <, a different mechanism.
• Case converter — normalize text before it goes into attributes or IDs.
• Text diff — spot the difference between a stored string and its escaped copy.
• Regex tester — test the /[&<>"']/g pattern used by most escape helpers.