HTML entities explained: escaping & < > the right way
HTML reserves five characters for markup: & starts an entity, < and > frame tags, and quotes delimit attributes. Drop a raw & or < into text content and the parser tries to read it as markup — at best your text breaks, at worst you have an injection hole. Entities are the escape hatch: each reserved character gets a safe textual stand-in like & or <, and hundreds more exist for symbols like ©, … and —, in named, decimal and hexadecimal numeric form.
One disambiguation worth stating plainly, because the two get confused constantly: HTML entity encoding is not URL encoding. Entities protect text inside an HTML document; percent-encoding (%20, %26) protects text inside a URL. If you are putting a value into a link, query string or redirect, entities will not help you — use the URL encoder at /url-encode for that. Encoding a URL with entities (or HTML with percent signs) is a classic source of broken pages.
Open the free HTML Entity Encoder/Decoder — no signup, runs entirely in your browser.
How to use it
- Paste the text to encode, or the entity-encoded HTML to decode.
- Pick Encode or Decode; in encode mode, tick the non-ASCII option if the output must be pure ASCII.
- Copy the result — malformed entities (missing semicolons, unknown names) are flagged with clear errors.
Why this one
- Encodes & first, so already-encoded text is never silently mangled on the way in.
- Apostrophes become ' — valid in every HTML version, unlike HTML5-only '.
- Decode follows real browser rules: Windows-1252 remapping, U+FFFD for impossible code points, single-pass so nothing double-decodes.
- Full named-entity table plus decimal and hex numeric references, emoji included.
Frequently asked questions
Why did my & turn into &amp; after encoding?
That is expected, and it is the #1 confusion with this tool. Encoding escapes every ampersand first — including the one inside an existing & — so encoding already-encoded text double-encodes it. If you meant to get back to plain text, switch to Decode; decoding runs in a single pass, so &amp; becomes & and stops there.
Should I use ' or ' for an apostrophe?
'. The named ' entity only became part of standard HTML with HTML5 — older parsers and some XML-adjacent toolchains do not know it. The numeric ' has worked everywhere forever, which is why this tool emits it on encode (while still decoding ' fine).
When should I encode non-ASCII characters as entities?
Rarely, these days — UTF-8 handles everything. The exceptions: email templates with flaky charset handling, legacy systems locked to ASCII, and contexts where a stray byte sequence could be misread. Numeric references like 😀 survive all of those, at the cost of readability.