HTML entity encoder and decoder

The five that matter

HTML gives special meaning to <, >, &, " and '. Escaping those five is what stops text being read as markup, and it is the difference between showing somebody a code sample and accidentally running it.

Encoding everything, and when to

The tool can also escape every character outside plain ASCII, either as numeric entities such as é or as named ones such as é. That is occasionally required by old systems and email templates that mangle UTF-8. It is not needed on a modern page served as UTF-8, where an accented letter can simply be itself.

Emoji

An emoji is a single character above the Basic Multilingual Plane, and a converter that walks a string by code unit splits it into two halves and produces two meaningless entities. This one encodes it as one entity of its real value, so the round trip is exact.

How the decoder works, and why that matters

The usual way to decode entities is to assign the text to an element's innerHTML and read its text back. That runs the HTML parser over untrusted input, which triggers image loads and other side effects even when the element is never added to the page. This decoder is a lookup table and arithmetic. It touches no DOM at all.

Example

<b>café</b> encodes to <b>café</b> and decodes back exactly.

Limitations

The named-entity table covers the several hundred names in common use rather than all 2,231 in the HTML specification. Anything it does not recognise is left exactly as written rather than guessed at.

Related tools

See remove HTML tags and the HTML to Markdown converter.