HTML ⇆ entities

Encoding everything is not safer than encoding the right things — it is just heavier and harder to read. The default here is the five characters that actually change how a parser reads your markup, with the rest available when you need them.

Scope: minimal · named · numeric
Context: body · attribute
Decodes: named · dec · hex

Step 1

Input

empty

Direction

Step 2

Encoded

Scope

empty

—

Nothing to convert yet Type or paste on the left.

The five that matter

CharNamedNumericWhy it needs escaping

&&& Starts every entity. Unescaped, the rest of your text can be swallowed into one.

<<< Opens a tag. This is the one that turns text into executable markup.

>>> Closes a tag. Less critical alone, but escaped for symmetry and safety.

""" Ends a double-quoted attribute value early. Only matters inside an attribute.

''' Ends a single-quoted attribute value early. ' is XML, not safe in old HTML.

Worth knowing

Encode the ampersand first

It is the one order that matters. Escape < to < before escaping & and you get &lt; — the text < instead of a less-than sign. This tool always does the ampersand first.

Attributes need more than the body

Inside value="…" a stray quote ends the attribute and everything after it becomes new attributes. Attribute-safe mode escapes both quote characters plus backtick, equals and whitespace-adjacent characters that can break an unquoted attribute.

' is not universally safe

It is defined in XML and XHTML but was never in HTML 4, so older parsers show it literally. ' works everywhere, which is why it is what this tool emits for an apostrophe.

Escaping is not sanitisation

Escaping makes text display as text. It does not make untrusted markup safe to insert — if you actually need to allow some HTML through, you need a sanitiser with an allow-list, not an encoder.

UTF-8 makes "encode everything" unnecessary

Numeric entities for every accented character were a workaround for pages served in Latin-1. On a UTF-8 page café is fine as-is, and entity-encoding it just makes the source unreadable. The option is there for legacy targets.

Decoding is deliberately broad

Decode handles named entities, decimal & and hex &, including the ones missing their closing semicolon, because real-world markup contains all of it.

Other tools

URL EncoderPercent-encoding, the other escaping. Unicode ConverterInspect the characters underneath. XML FormatterFormat the markup you just escaped. Base64 EncoderFor binary-safe transport.