HTML Entity Encoder and Decoder

What Are HTML Entities and Why Use Them?

HTML parsers treat certain characters as part of the markup syntax. Less-than and greater-than signs delimit tags, the ampersand starts a character reference, and quotes delimit attribute values. If these characters are written raw where they should appear as text, the structure of the page can change in unexpected ways.

Entity references are the standard way to express these characters as text. The tool helps when you prepare code samples for display, untangle syntax collisions in templates, or read encoded text that came from an external source.

Five Characters, Three Output Formats and the Decode Contract

Encoding converts only five characters. Turkish letters, other scripts and emoji stay as they are:

• Ampersand (&): Named as &, decimal as &, hexadecimal as &
• Less than (<): Named as &lt;, decimal as &#60;, hexadecimal as &#x3c;
• Greater than (>): Named as &gt;, decimal as &#62;, hexadecimal as &#x3e;
• Double quote ("): Named as &quot;, decimal as &#34;, hexadecimal as &#x22;
• Single quote ('): Named as &apos;, decimal as &#39;, hexadecimal as &#x27;

The decode contract is deliberately small. The supported names are amp, lt, gt, quot, apos and nbsp, and names are case-sensitive. In addition, valid decimal and hexadecimal Unicode scalar references that end with a semicolon are decoded. Other names (such as ©) are kept as written with a warning. NUL, the surrogate range and out-of-range numbers are also kept with a warning.

Decoding is single-pass: < becomes < in the first step and is not decoded a second time. The character count uses user-perceived characters (graphemes), so one emoji counts as one character.

The Semicolon Contract and Browser Parsing

This tool decodes a reference only when it ends with ;, so &amp or &#38 stay untouched. That is a deliberate, limited tool contract, not full HTML5 parsing. The WHATWG table also lists the semicolon-less forms of some legacy names, which is why browser parsers can decode some references without a semicolon. This tool does not imitate that behavior and does not copy every name in the table.

As a result, the output of this tool and a browser parsing the same text are not guaranteed to match. If you need exact browser behavior, test in your target browser as well.

Security Boundaries and Contexts

Encoding the five characters suits HTML text nodes and correctly quoted attribute values. Unquoted attributes, script blocks, event handler attributes such as onclick, CSS and URL attributes are outside the scope of this tool, and each context has its own escaping rules. Encoded text is not automatically safe in every context.

For example, an entity-encoded javascript: address in an href is still interpreted after the browser decodes the attribute value. Writing decoded output into a page with innerHTML also re-activates its tags. Safe data handling needs context-appropriate template escaping and measures such as a content security policy; for type safety in modern projects see Modern Web Projects with TypeScript.

Where Your Input Does Not Go, and the Share Link

The code of this tool does not send your text to a server, write it to browser storage or add it to a share link. Conversion is plain string processing in the browser's JavaScript runtime; decoding uses no DOMParser, innerHTML, iframe or eval. Input containing tags such as </textarea> and <img> is processed only as text. This covers the tool's own behavior; when the page loads, the browser makes ordinary network requests for the site's files.

The share link carries only the mode and output format you selected. Your text is not added to the link and is not restored when the link is opened.

Source and Fact-Check Date

The named reference information on this page was checked on 25.10.2026 against the WHATWG HTML named character references table. The table contains many more names; the small support set of this tool is a design choice and does not replace it.