Convert special characters to HTML entities or decode entities back to plain text — instantly, no signup.
& — &< — <> — >" — "' — ' — non-breaking space© — ©® — ®— — —€ — €HTML encoding converts characters that carry special meaning in markup — <, >, &, and quotes — into HTML entities like <, >, and & that a browser renders as visible text instead of interpreting as code. It matters for two reasons: correctness, because an unencoded < in body text is read as the start of a tag and can break your layout; and security, because encoding user-supplied input before it lands in a page is the baseline defense against XSS (Cross-Site Scripting).
The most commonly used HTML entities, covering reserved characters, symbols, and punctuation:
| Character | Entity name | Entity number | Description |
|---|---|---|---|
| & | & | & | Ampersand — must always be encoded |
| < | < | < | Less-than — opens HTML tags if unencoded |
| > | > | > | Greater-than — closes HTML tags |
| " | " | " | Double quote — encode inside attributes |
| ' | ' | ' | Single quote / apostrophe |
| © | © | © | Copyright symbol |
| ® | ® | ® | Registered trademark |
| € | € | € | Euro sign |
| £ | £ | £ | Pound sterling |
| ✓ | ✓ | ✓ | Check mark |
| × | × | × | Multiplication / close symbol |
| → | → | → | Right arrow |
| ← | ← | ← | Left arrow |
| |   | Non-breaking space | |
| — | — | — | Em dash |
The tool has two modes, switchable with the Encode / Decode tabs at the top of the tool card:
<, >, &, ", and ' into their safe entity equivalents. Use this when you want to display HTML code visually on a web page, or when sanitizing user input before inserting it into a template.< back to <, & back to &, and so on — giving you the readable, original text.Every entity has two forms. A named entity uses a memorable keyword — © for ©, — for —. A numeric entity uses the character's Unicode code point in decimal (©) or hexadecimal (©). Both render identically. Named entities read better in source, but only a fixed set of characters has a name; numeric references work for any character, which is why they are the safer choice for obscure symbols and emoji. Note that ' (the named form of ') is only valid in XHTML — for the apostrophe in plain HTML, prefer the numeric ', which is exactly what this tool emits in Encode mode.
The two are easy to confuse but solve different problems. HTML encoding produces entities like < so a character is safe inside an HTML document. URL encoding produces percent sequences — a space becomes %20, & becomes %26 — so a value survives intact inside a URL or query string. Encoding HTML where you needed a URL (or vice versa) produces text that looks escaped but breaks at the wrong layer. If you need the URL version, use the URL Encode / Decode tool.
For valid HTML you only need to neutralize the characters the parser treats as syntax: &, <, and > in text, plus " and ' when the value sits inside an attribute. Everything else — letters, digits, accented characters, emoji — is legal as-is in a UTF-8 document. This tool encodes exactly those five (escaping & first so existing entities aren't double-encoded), which is enough to render code as text and to block XSS in element content.
&lt; back into a real tag?No, and that is correct behavior. Decoding reverses one layer: &lt; decodes to <, not to <. The doubled & means the text was encoded twice (double-encoding), so it takes two decode passes to recover the original. Run Decode again — or use the Swap button to feed the output back in — if you still see stray & sequences.
No. Entity encoding protects values placed in element content and quoted attributes, but it does not make user input safe inside a <script> block, a style attribute, an href/src URL, or an inline event handler — those contexts need their own escaping or an allow-list. Treat this tool as the text-context layer of a broader output-encoding strategy, not a complete XSS fix.
become a normal space when I decoded?Decode mode resolves to its real character: U+00A0, the non-breaking space. It looks like an ordinary space in a textarea but is a distinct code point, which is why a "space" copied from a web page sometimes won't match a regular space in search-and-replace. Re-encode the text and it returns to .