HTML Entity Encoder and Decoder
Escape HTML special characters, convert to named entities, or decode back.
About this tool
Converts text to and from HTML entities.
Two different jobs share this syntax and the tool keeps them apart. Escaping the five characters that carry meaning in HTML — `&`, `<`, `>`, `"`, `'` — is what stops text being read as markup. Converting `é` to `é` is a legacy formatting habit from before UTF-8 was reliable, and does nothing for safety.
If you are escaping user input before putting it in a page, you want the first mode. Encoding everything is not more secure; it just produces a larger file.
Common questions
Which characters must be escaped?
In page content, & < and >. Inside an attribute value, also " and '. Everything else can be a literal UTF-8 character, and normally should be.
Do I still need entities for accented characters?
No. Serve the page as UTF-8 with a charset declaration and write é directly. Named entities for accents are a workaround for a problem that stopped existing about twenty years ago.
Does escaping prevent XSS?
Escaping in the right context is a large part of it, but context decides the rules — inside a script block or a URL attribute, HTML escaping alone is not enough. Use your framework's context-aware escaping rather than a manual pass.
What is the difference between ' and '?
They mean the same character. ' is the numeric form and works everywhere, including old HTML 4 parsers where ' was not defined. The numeric form is the safer habit.