Decode every named and numeric HTML entity, list what was found, and fix double-escaped text.
HTML Entity Encoder
Escape text so it displays as text in HTML — for showing code snippets, user input or special characters — with control over quotes and non-ASCII characters.
Encoded locally in your browser — your code is never uploaded
How it works
&→&,<→<and>→>, always.- With “Escape quotes” on,
"→"and'→', so the text is also safe insideattr="…"orattr='…'. - Non-ASCII characters are left alone by default (fine for UTF-8 pages). You can also write them as named entities (about 70 common names, such as
—andé), decimaléor hexé. Emoji and other characters outside the Basic Multilingual Plane become a single entity, not broken surrogate pairs.
Example
<p class="note">Fish & chips — R85 “special”</p> becomes <p class="note">Fish & chips — R85 “special”</p>. Put that inside a <pre> and readers see the tag itself instead of a paragraph.
With “Named where possible”, the dash and curly quotes become —, “ and ”.
Frequently asked questions
Which characters must be escaped in HTML?
In text, escape & and < (as & and <); > is usually escaped too. Inside an attribute value, also escape the quote character that surrounds it (" or '). “Essential only” does exactly this.
Do I need to escape accents and emoji?
Not if your page is served as UTF-8, which almost every modern page is. Encode them only for systems that can’t handle UTF-8 — use numeric entities, which work for every character, or named ones for readability.
Is escaping enough to prevent XSS?
Escaping text before inserting it into HTML content or quoted attributes is an essential defence, but context matters: URLs, inline JavaScript and CSS need different handling. Prefer your framework’s built-in escaping.
Is my code sent anywhere?
No. Encoding runs in your browser; nothing you paste is uploaded or stored.
Related tools
Percent-encode a query value, a whole URL or form data, line by line if you like, with double-encoding warnings.
Count characters, bytes and SMS segments, and check text against common platform limits.
Generate random v4 or time-ordered v7 UUIDs in bulk, in the format you need.
Related guides
JSON, Base64, URL encoding and HTML entities explained
What JSON, Base64, percent-encoding, HTML entities, UUIDs and Unix timestamps are for — and the common mistakes developers make with each.
· 7 min read
CSS colour formats explained: HEX, RGB, HSL, HWB and OKLCH
What each CSS colour format means, when to use it, why OKLCH is useful for palettes, and how to check colour contrast for accessibility.
· 7 min read
JWTs explained: structure, claims, decoding vs verifying, and common mistakes
How JSON Web Tokens work, what each part and claim means, why decoding isn't verifying, and the mistakes that cause real security bugs.
· 8 min read