HTML Entity Encoder & Decoder
Escape text for safe insertion into HTML, or decode entities back to readable characters, with a choice of named, decimal and hexadecimal references.
Photo by Florian Olivo on Unsplash
HTML entity encoder and decoder
Characters that were encoded
| Char | Named | Decimal | Hex | Name |
|---|
Key takeaways
- Only five characters strictly require escaping in HTML: & < > and the two quote marks.
- The correct escaping depends on context — HTML text, attributes, JavaScript, CSS and URLs each need a different scheme.
- With a UTF-8 charset declared you can write accented characters and symbols literally; entities are no longer needed for them.
Why HTML entities exist
HTML has five characters that cannot appear literally in content without changing how the document parses: &, <, >, " and '. Writing 5 < 10 without escaping starts a tag; writing an ampersand followed by a word can start an entity. Escaping replaces each with a character reference that the parser turns back into the original character.
There are three reference syntaxes and they are interchangeable:
- Named:
&,©,—. Readable, but only about 2,200 names exist. - Decimal:
©— the Unicode code point in base 10. Works for every character. - Hexadecimal:
©— the same code point in base 16, matching the U+ notation used in the Unicode standard.
Escaping is your XSS defence
Cross-site scripting is, at heart, an escaping bug. If user input reaches the page unescaped, <script> in that input becomes a real script tag. Escaping the five special characters turns it into inert text.
The critical detail is that the correct escaping depends on where the value lands:
| Context | Required escaping |
|---|---|
| HTML text content | Escape & < > |
| Attribute value | Also escape quotes, and always quote the attribute |
| Inside <script> | JavaScript string escaping — HTML entities are not decoded there |
| Inside a URL | Percent-encoding, via the URL encoder |
| Inside CSS | CSS escaping rules, different again |
Use your framework’s auto-escaping and treat manual escaping as a last resort. React, Vue, Angular, Django, Rails and Laravel all escape interpolated values by default; the vulnerabilities appear precisely where a developer opts out with dangerouslySetInnerHTML, v-html or |safe. See the OWASP XSS prevention cheat sheet.
What actually needs encoding today
Modern documents are served as UTF-8, so accented letters, currency symbols, arrows and emoji can all be written literally. Café and Café render identically, and the literal version is easier to read, search and edit.
Encode when:
- The character is one of the five syntax characters.
- You need a non-breaking space (
) or another invisible character where a literal one would be ambiguous. - The content passes through a pipeline you do not control that might mangle the encoding — some email clients and legacy CMS fields still do.
- You are writing code samples that display markup, as this page does.
Always declare the encoding: <meta charset="utf-8"> as the first thing in <head>. Without it, browsers guess, and guessing wrong is what produces Café.
The entities worth memorising
| Character | Named | Numeric | Use |
|---|---|---|---|
| & | & | & | Required in text and attributes |
| < | < | < | Required in text |
| > | > | > | Required in text |
| " | " | " | Required in double-quoted attributes |
| ' | ' | ' | Required in single-quoted attributes |
| (space) | |   | Prevents a line break — use sparingly |
| © | © | © | Copyright |
| — | — | — | Em dash |
| … | … | … | Ellipsis |
| → | → | → | Right arrow |
The full list is in the HTML entities reference.
Frequently Asked Questions
What is an HTML entity?
A character reference that stands in for a literal character, so the parser does not misread it as markup. < produces a < character without starting a tag.
Do I still need entities for accented characters?
No, provided your page declares UTF-8. Write café directly. Entities remain necessary for the five syntax characters and useful for invisible characters such as the non-breaking space.
What is the difference between and a normal space?
A non-breaking space prevents a line break at that point and is not collapsed with adjacent whitespace. Use it between a number and its unit; do not use it for layout spacing — that is CSS's job.
Does encoding prevent XSS?
Correct contextual encoding is the core defence, but the required encoding differs between HTML text, attributes, JavaScript, CSS and URLs. Rely on your framework's auto-escaping and never build HTML by string concatenation from user input.
Why does my text show é instead of é?
UTF-8 bytes are being decoded as Latin-1. Fix the declared charset and the HTTP Content-Type header rather than re-encoding the content. Our encoding guide covers the whole class of problem.
Should I use named or numeric references?
Named references are more readable but only cover about 2,200 characters. Numeric references work for every code point. Both are equally valid in HTML5; XML supports only five named ones.
Sources & further reading
- WHATWG HTML: Named character references — the authoritative list of all named entities
- OWASP XSS Prevention Cheat Sheet — context-by-context escaping requirements
- W3C i18n: Using character escapes — when escaping helps and when it hurts internationalisation
- Unicode character charts — code point lookup for numeric references