What HTML entities are
In HTML, < starts a tag and & starts an entity. To show those characters as text, you write them as entities: < for <, & for &. Entities can name any character too — é is é, 👋 is 👋.
Escaping is what stops user input from turning into markup: text escaped before it goes into a page cannot become a tag or a script. That only holds for the place it was escaped for — see the last card.
- The five that matter
& < > " '— escape these and text cannot break out of HTML or a quoted attribute. - Named
© — — readable, but only for characters that have a name. - Numeric
éoréworks for every character. - Context mattersHTML escaping is not JavaScript, CSS or URL escaping. Escape for where the text goes.
How to use the HTML entity encoder
- Pick Encode to make text safe to paste into HTML, or Decode to read escaped HTML.
- By default only the five special characters are escaped — the minimum that is always correct.
- Tick Encode Everything Non-ASCII for a file that must stay ASCII-only; Prefer Named Entities uses
éwhere a name exists. - Decoding understands every named entity in HTML, plus decimal and hex ones.
- If the result still shows entities, it was escaped twice — press Use as Input and decode again.
Examples
Show HTML as text
Paste a snippet into a blog post or docs page without it rendering.
Read escaped text
Text copied from page source or an API, entities and all.
Make text ASCII-only
Every non-ASCII character becomes a named or numeric entity.
Spot double escaping
&amp; on a page means something escaped it twice.
Frequently asked questions
Do I need to escape quotes?
Inside an attribute value, yes — escape the quote that surrounds it, or text can end the attribute early. In normal page text, only & and < are strictly needed; escaping all five is the safe default.
Is escaping enough to prevent XSS?
For text placed in HTML content or a quoted attribute, yes. Not for text placed in a <script>, a style, an event handler or a URL like href — each needs its own escaping. Frameworks that escape by default (React, Jinja) get this right; avoid bypassing them.
Why is different from a space?
is U+00A0, a no-break space: it looks like a space but stops a line break, is not trimmed, and fails string comparisons with a normal space. The Unicode Escapes tool shows which one you have.
' or '?
Both mean an apostrophe in HTML5. ' also works in old HTML and in every email client, so it is the safer choice.
Is my text sent anywhere?
No. Encoding and decoding run in your browser; decoded HTML is never rendered or executed.