HTML Entity Encode & Decode
Escape characters to HTML entities and decode them back — deterministic, no DOM guesswork.
HTML entities let you show reserved characters as literal text instead of markup. Encoding escapes the five specials: <b> becomes <b>, and & becomes &. Decoding reverses it, turning ' and © back into ’ and ©. Encode the ampersand first so entities never double-escape.
What HTML entities are
In HTML a few characters carry structural meaning — & starts an entity, < and > delimit tags, and quotes wrap attribute values. To display those characters as plain text rather than have the browser interpret them, you replace each with an entity: a code that begins with & and ends with a semicolon. Entities come in two flavours: named (like © for ©) and numeric (like © or the hexadecimal ©). Both resolve to the same character.
Named uses a keyword; numeric uses the Unicode code point in decimal or hex.
The five that always need escaping
The core set is & < > " and '. The ampersand must be encoded first — if you replaced < with < before escaping &, that new ampersand would itself get turned into &lt;, corrupting the output. Encoding character by character (and never re-scanning what you just wrote) avoids that entirely. Everything else on the page is optional: you only need to encode non-ASCII characters like é or © when your file encoding cannot store them directly.
- 1 Choose Encode. The Encode segment escapes reserved characters in your text.
- 2 Escape the ampersand first. Every & becomes & before anything else, so no entity gets escaped twice.
- 3 Escape the angle brackets and quotes. < → <, > → >, " → ", and ’ → '.
- 4 Optionally encode non-ASCII. Switch “Non-ASCII characters” to Numeric entities and é becomes é.
- 5 Copy the result. <a href="x">Tom & Jerry</a> becomes <a href="x">Tom & Jerry</a>.
Common HTML entities
The five specials plus two everyday extras. Numeric forms work everywhere; named forms are easier to read.
| Character | Named entity | Numeric entity | Purpose |
|---|---|---|---|
| & | &amp; | &#38; | Starts every entity — escape it first |
| < | &lt; | &#60; | Opens a tag |
| > | &gt; | &#62; | Closes a tag |
| " | &quot; | &#34; | Wraps attribute values |
| ' | &#39; | &#39; | Apostrophe (&apos; is XML, not classic HTML) |
| &nbsp; | &#160; | Non-breaking space | |
| © | &copy; | &#169; | Copyright sign |
Why encode, and named vs numeric
Encoding does two jobs. First, it prevents markup injection: user text containing <script> is rendered as harmless literal characters instead of running as code. Second, it lets you display reserved or unusual characters exactly as written. Choose named entities when readability matters — © is clearer than ©. Choose numeric entities for anything without a well-known name, or when you want output that works in strict XML, which recognises only five named entities. Decoding here is pure string work — a named-entity lookup plus a regex for the numeric forms — so it never depends on a browser DOM and always gives the same result.