HTML Entity Encoder / Decoder
Encode and decode HTML entities, named or numeric. Runs in your browser.
About this html entity encoder / decoder
This HTML entity encoder turns characters like <, & and " into entities such as <, & and ", and the decoder turns any entity back into the character it stands for. It is for developers pasting code into a blog post, people fixing text that shows up as &amp; in a CMS, and anyone who needs a © or → that survives every email client.
You choose how much to encode: only the five markup characters, every non-ASCII character too, or everything. You also choose the style: named (é), decimal (é) or hex (é). Decoding uses your browser's own table, so all 2,000+ HTML5 names work, not just the common ones.
Nothing leaves the page. The text you paste is processed in your browser and never uploaded.
Features
Three encoding levels
Encode only & < > " ' for safe display on a UTF-8 page, add every character above ASCII for old systems and email, or encode everything, letters included, to obscure an address from simple scrapers.
Named, decimal or hex output
Named mode uses é or € where a name exists and falls back to a decimal number for the rest, such as 😀 for an emoji. Hex mode writes 😀.
Full HTML5 decoding
Named entities from the full HTML5 list, decimal and hex references, references without the final semicolon, and the old Windows-1252 rule that turns € into €. Unknown names are left alone and listed.
Double-encoding detection
If the decoded text still contains entities, as with &lt;, the tool says so and decodes again with one click.
Character table
Every special character in your text gets a row with its code point and its named, decimal and hex forms. Click any form to copy it.
Searchable entity reference
253 named entities grouped into markup, Latin letters, currency, math, arrows, Greek and spaces. Search by name, by the character itself, or by number.
How to use the html entity encoder / decoder
- 1Pick Encode or Decode, then paste your text or HTML.
- 2For encoding, choose which characters to encode and the format: named, decimal or hex.
- 3Copy the result, or send it back as input to check the round trip.
When to use it
Showing code in a blog post
Paste a snippet such as <div class="card">, encode it, and put the result inside <pre><code>. The browser shows the tags instead of rendering them.
Fixing &amp; in a CMS or feed
Text that has been escaped twice shows the entity itself. Decode once, check the result, and decode again if the tool reports leftover entities.
Special symbols in email templates
Some email clients still mangle raw UTF-8. Writing © as © and € as € keeps them intact everywhere.
Reading scraped or exported data
Product names from an API or a CSV export often arrive as Café or ’. Decode them to get clean text before you import it.
What is an HTML entity?
An HTML entity, which the HTML standard calls a character reference, is a piece of text that starts with & and ends with ; and stands for one character. The parser replaces it with that character before showing the page. There are three forms: a name (©), a decimal code point (©) and a hex code point (©). All three give ©.
Entities exist for two reasons. Some characters have a job in HTML: < opens a tag and & opens an entity, so writing them literally can break the page. Others were hard to type or could not be stored in the page's character encoding in the days before UTF-8 was everywhere.
Which characters do you have to encode?
On a page served as UTF-8, very few. In normal text you must encode & and <. Encoding > as well is a good habit, since it keeps the source readable. Inside an attribute value, also encode the quote character that wraps the value: " for double-quoted attributes, ' for single-quoted ones.
Everything else, including é, ü, € and emoji, can be written directly. The "non-ASCII" mode is for systems that are not UTF-8, some email pipelines and old databases, where a raw é turns into é.
- & becomes & (always)
- < becomes < (always in text)
- > becomes > (recommended)
- " becomes " (inside double-quoted attributes)
- ' becomes ' (inside single-quoted attributes; ' works in every HTML version, while ' was only added in HTML5)
Named, decimal or hex: which one should I use?
They are equal to a browser, so pick what is easiest to read. Named entities like — and are easy to recognise in source code, but only about 250 of them are well known and XML only knows five (& < > " '). Numeric references work for every Unicode character and in every HTML or XML parser.
A good rule: named for the markup characters and familiar symbols, decimal or hex for everything else. If the output will be read by an XML tool, such as an RSS feed or an SVG file, use numeric references only. For other escaping jobs, such as JSON strings or SQL, the string escape tool covers those rules.
Does HTML encoding prevent XSS?
Partly. Encoding < & " ' stops user text from being read as tags or from breaking out of a quoted attribute. That is the right fix when you insert text into HTML body content or a quoted attribute value.
It does not make text safe inside a <script> block, an onclick handler, a URL such as href="javascript:...", or a style attribute. Each of those contexts has its own rules. Let your template engine escape by context, keep a Content Security Policy, and treat this tool as a way to prepare and check content, not as a security layer.
Why use Mavros
| Mavros | Typical upload sites | |
|---|---|---|
| Decoding coverage | Full HTML5 list via the browser, plus numeric forms | A few hundred names |
| Encoding levels | Markup only, non-ASCII, or everything | One fixed level |
| Output style | Named, decimal or hex | Usually one style |
| Emoji and astral characters | Encoded as one code point (😀) | Sometimes split into two broken halves |
| Double-encoding check | Detected, with a Decode again button | None |
| Privacy | Runs in your browser, nothing uploaded | Text sent to a server |
Tips
- is not a normal space. It stops a line break between two words, so use it in "10 kg" or "Mr. Smith", not to add spacing. For layout, use CSS.
- If you see &eacute; on a page, the text was encoded twice. Fix the step that encodes it, not just the output.
- Hex and decimal references need the code point, not the UTF-8 bytes. The emoji 😀 is 😀 (U+1F600), never four separate byte values.
- Building the page around the snippet? Test the result live in the HTML playground.
- Entities are not URL encoding. A space in a link is %20, which the URL encoder handles, and binary data belongs in Base64.
Questions
How do I decode HTML entities?
Switch to Decode, paste the text, and copy the result. Named entities such as é, decimal ones such as é and hex ones such as é all turn into é. Anything that is not a real entity is left as it is and listed below the output.
What is the entity for a non-breaking space?
, which is the same as   or  . It looks like a space but stops the browser from breaking the line there, and repeated characters are not collapsed into one.
Why does my page show &amp; instead of &?
The text was encoded twice. The first pass turned & into &, and a second pass encoded that & again. Decode until no entities remain, then make sure only one layer of your code escapes output.
Should I use ' or ' for an apostrophe?
' is the safer choice. It works in HTML 4, HTML5 and XML. ' is valid in HTML5 and XML but was not part of HTML 4, so very old parsers may show it literally. This tool writes '.
Do I need entities for accented letters?
Not on a UTF-8 page, which almost every modern site is. Write é directly. Use entities only when the text passes through a system that is not UTF-8, such as some email tools or legacy databases.
What does € mean?
By the HTML standard, numeric references from 128 to 159 are read as Windows-1252 characters, so € shows €, not an invisible control character. The tool decodes them the same way and tells you when it happens.
Can I encode an email address to hide it from spam bots?
You can, with the Everything mode, and it stops the simplest scrapers. Any scraper that runs an HTML parser decodes it instantly, so treat it as a speed bump, not protection.
Is my text uploaded?
No. Encoding and decoding run in your browser tab. You can disconnect from the internet after the page loads and it still works.