HTML Entities Encoder and Decoder

How to escape or unescape HTML

1. Choose Escape or Unescape.
2. For escaping, pick what to escape under Escape:
   • Only & < > " ‘ for HTML you will paste into a page or template.
   • Plus all non-ASCII for pages, emails or systems that are not UTF-8 safe.
   • Every character to encode all text, for testing parsers.
3. Pick the Format: Named (é), Decimal (é) or Hex (é). Named falls back to decimal for characters that have no common name. Untick Escape quotes if the text only goes into element content.
4. Copy output. Swap moves the result to the other side for a round-trip check.

Unescaping uses the browser’s HTML parser, so every one of the more than 2,000 named references in HTML5 is supported, along with decimal and hex references. The input is never rendered as HTML.

Common entities

Numeric references use the Unicode code point. The emoji takes four bytes in UTF-8 but only one reference.

Pitfalls when escaping and decoding

• Escape & first. Replacing < with < and then & with & produces <. Any hand-written escaper must handle & before the others.
• Unencoded & in text can turn into a symbol. HTML still recognizes some legacy entities without a semicolon, so the text ?id=1&copy=2&para=3 displays as ?id=1©=2¶=3. Write & for every ampersand, in URLs too.
• Double escaping shows up as <b> on the page. Unescape once, then find which layer escapes twice.
•   is not a space. It decodes to U+00A0, which looks like a space but fails string comparisons and trim() in some languages.
• Entities are not URL encoding. In a link, & separates query parameters in the HTML source, while %26 is a literal ampersand inside a value. The URL encoder handles the second.

Escaping and unescaping in code

import html
html.escape('5 > 3 & "quotes"')    # '5 > 3 & "quotes"'
html.unescape("Café — ©")   # 'Café — ©'

const escapeHtml = s => s.replace(/&/g, "&amp;").replace(/</g, "&lt;")
  .replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");

const unescapeHtml = s =>
  new DOMParser().parseFromString(s, "text/html").documentElement.textContent;

Python’s html.escape escapes quotes by default and writes ' as '. PHP’s htmlspecialchars() is the usual choice there; since PHP 8.1 it escapes both quote types by default. DOMParser does not run scripts in the parsed document, which makes it a safe way to decode in the browser. For more JavaScript string handling see the JavaScript page.

Entities, Base64 and data URIs

HTML entities and Base64 solve different problems. Entities make characters safe inside HTML source; Base64 turns bytes into text so a whole file fits into an attribute. To embed a complete HTML document in a data: URI or a JSON field, encode it with HTML to Base64 instead of escaping every character.

FAQ