HTML Entity Encoder
And A Decoder That Forgives
This HTML entity encoder turns text into named, decimal or hexadecimal entities, and turns them back again. It encodes the five characters HTML reserves by default, and everything outside ASCII when you ask.
- FreePrice
- 3Forms
- NoneSign-up
- NoneUploads
Denwix HTML Entity Encoder plus Decoder
Text to entities and back, with the rules stated
- Characters in
- 0
- Converted
- 0
- Characters out
- 0
Five characters genuinely need encoding in HTML: the ampersand, both angle brackets and both quotes. Everything else is a choice about safety margins.
Ready. Paste something and it converts as you type.
Which Characters HTML Reserves
Five characters mean something to a parser. The ampersand starts an entity, the two angle brackets open and close a tag, and the two quotes end an attribute value.
Letters and digits pass through the encoder untouched. So an accented letter, an em dash and an emoji all pass through a UTF-8 document untouched.
So encoding is narrower than most people assume. In body text you need three of the five, and inside an attribute you need the matching quote as well.
The full list of names lives in the HTML standard, and it runs to over two thousand entries, plus a short set of numeric codes that stand for any character at all. You need hardly any of them in practice.
Named, Decimal Or Hexadecimal
Named entities read well, because an tells you what it is. A  , however, tells you only a number.
Numbers always work. Every code point has one, no lookup table comes into it, and nothing rests on a parser knowing a name.
Hex writes that same number in base 16. Use it when you copy values from a Unicode chart, since charts print them that way.
When To Encode Everything
A document served as UTF-8 needs no entities for accents at all, since the characters are simply characters. Then the browser reads them correctly.
Encoding everything outside ASCII is insurance against a server that sends the wrong charset. It makes the file bigger and far harder to edit.
Therefore reach for it only when you cannot control the headers. A correct charset declaration is the better fix in every other case.
Entities Are Not Sanitisation
Encoding text before you print it into a page stops it becoming markup. That is escaping, and the rules shift with the place: an attribute, a script block and a URL each need a different one.
Why Decoding Is The Harder Half
Real documents carry named entities, decimal ones, hexadecimal ones, and plenty with the semicolon missing. So a decoder has to handle all four.
It also has to leave alone anything that merely looks like an entity. The word &foo; is text, and a decoder that guesses at it corrupts prose.
This decoder checks names against its table and code points against the valid range. Anything it does not recognise comes back exactly as written.
Where Entities Still Turn Up
Old email templates carry them by the hundred. So do CMS exports and PDF conversions, and so does anything that once passed through a word processor.
They also show up in CSV files pulled from a web page. For example, a column of names full of amp and rsquo is the usual sign.
Decoding such a file once makes it readable again. Then you can see the stray quotes and dashes that were hiding as codes.
Still, hold on to the original text. If a value was meant to stay encoded, you will want to put it back.
The Non-Breaking Space Problem
Word processors insert them, and they look identical to a normal space on screen. They then break your line wrapping and your string comparisons. Decoding a pasted block is the quickest way to find them.
Working With the Entity Converter
Three steps, and the result follows every keystroke. The swap button handles the round trip.
- 1
Pick a direction
Encode swaps special characters for entity codes. Decode turns entities back into characters, including the ones missing a semicolon.
- 2
Choose the form
Named where one exists, or numbers in decimal or hexadecimal. Numbers always work, which makes them the safer default for machines.
- 3
Choose how much to encode
Leave the ASCII switch off for normal work. Turn it on when a server sends the wrong charset and you cannot fix the headers.
- 4
Copy, or swap and check
Press Move result to the left and the direction flips. Converting again should return exactly what you started with.
What Sets This Entity Tool Apart
Most converters do one direction well and guess at the other. Here are the gaps that affect real pages.
It leaves unknown names alone
Text that looks like an entity but is not stays as written, because a decoder that guesses corrupts prose quietly.
Three output forms
Named, decimal and hexadecimal come from one switch, so you can match whatever the surrounding file already uses.
Missing semicolons handled
Real documents drop them, and browsers forgive a known name. So this decoder does the same rather than failing.
A reversible round trip
Swap the panes and convert again. If anything fails to return to its starting text, you have found a bug in one step.
No DOM tricks
This site blocks the usual innerHTML trick by design, so the tables sit in the file and each swap happens in the open.
Nothing leaves your tab
Template fragments and customer data pass through converters like this one. This Denwix encoder keeps all text in your browser.
Rules For Encoding HTML Special Characters
Escaping is one of those jobs where the right habit is shorter than the wrong one.
- Encode when you print the text, not when you store it. Save the raw input exactly as entered. Then encode when you print it, and encode for the exact place it lands.
- Use your framework function. Every language has one, and it knows where the text will land. A hand-rolled chain of replacements misses a case sooner or later.
- Send pages as UTF-8 and say so in the head. Then accents and emoji need no entities at all. Above all, this is the fix that makes the whole question go away.
- Encode both quotes inside attributes. A single quote closes a single-quoted attribute, just as a double closes a double-quoted one. So encode both and stop thinking about it.
- Prefer numeric entities in generated files. No name table comes into it, so nothing rests on a parser knowing a word. Names help the people reading your source.
- Watch for double encoding. An ampersand encoded twice shows as
&on the page. Therefore decode once and look, before you encode again. - Hunt non-breaking spaces in pasted copy. They come from word processors, and they break wrapping. Decode a block, then the stray ones become visible.
- Check exports after a CMS move. A migration is where double encoding creeps in. So decode a sample of the new pages, then compare it with the old ones.
- Keep the same form across a file. Mixing names and numbers in one template makes a search for a stray character much harder later on.
- Never escape to sanitise markup. Escaping makes text safe to print. Allowing some tags and removing others is a different job that needs a real sanitiser.
Six Entity Mistakes That Reach Production
These pass review because the page renders. The damage shows up in a feed, an export or a search index.
Double encoding
The most common one. When the template escapes a value and the framework escapes it again, the reader sees raw entity text.
Encoding everything by default
It doubles the size of a page of French or Urdu, and it makes the source unreadable. So fix the charset instead.
Escaping text for the wrong part of the page
Entity encoding alone fails inside a script block or a URL parameter. Every place in a page escapes differently.
Named entities in XML
XML knows five names and no more. Therefore an
in a sitemap or an RSS feed is a parse error.Forgetting the quote inside attributes
It ends the attribute early, and then it leaves the rest of the value as markup. That is how an injection starts.
Trusting escaping as a security control
Correct escaping prevents injection at the point of output. It does nothing about what you stored or what you allowed.
Entity Questions People Ask
Which characters must I encode in HTML?
Three in body text: the ampersand and both angle brackets. Inside an attribute value, encode the quote character as well, and encoding both quotes is simpler to remember.
Should I prefer names or numbers?
Named ones read better in source. Numeric ones always work, need no table, and are the safer choice in a file a machine generates.
Does this work as an html entity decoder online?
Yes, and it handles named, decimal and hexadecimal entities, including the ones that arrive without a semicolon. Unknown names are left exactly as written.
Why do I see & on my page?
Something encoded the text twice. Decode once here to see the original, then find the second escape in your template or framework.
Do I need entities for accented letters?
Not in a UTF-8 document with a correct charset line. Encode them only when you cannot control how a server sends the file.
Can I use these entities in XML or RSS?
Use numeric ones. XML defines only five named entities, so anything else, including nbsp, breaks the feed.
What about html special characters in email?
Email clients parse HTML with older engines, so numeric entities are the safer choice there. Test in a real client before a send.
Is encoding the same as sanitising?
No. Encoding makes text display as text. Sanitising decides which tags may stay as markup, and that job needs a purpose-built library.
Can I decode a whole file here?
Paste it in. The tool handles a long page without slowing down, and the counts tell you how many codes it swapped.
Which entities break an RSS feed?
Any named one except the five XML defines. An nbsp is the usual culprit, and swapping it for a numeric code fixes the feed.
Why does my copy show strange quote marks?
A word processor inserted curly quotes and something encoded them twice. Decode the block once here, and the real characters come back.
Should I escape the apostrophe in my HTML?
Inside a single-quoted attribute, yes, and the quotes switch here does it for you. In body text an apostrophe is ordinary punctuation, so it can stay exactly as typed.
Why did my ampersand survive untouched?
Because the encoder ran in decode mode, or the character was already part of an entity. Switch the direction and convert again to see the difference.
Does the text I paste into this Denwix tool leave my browser?
No. Encoding and decoding both stay inside this tab. Nothing reaches this site, this site keeps no copy, and closing the tab clears it.
Denwix Tools for HTML Work
Entities are one part of handling HTML by hand. Three more handle everything else.
HTML Minifier
Compress markup, or beautify it back into something readable.
Open tool →HTML Tag Stripper
Pull the plain text out and keep the paragraph breaks.
Open tool →Base64 Encoder and Decoder
Encode bytes for a data URI or a header value.
Open tool →
Ready To Convert Something?
Paste a block, pick a direction, and swap the panes to check the round trip. The HTML entity encoder is free, needs no account, and runs entirely in your browser.