HTML Entity Encoder and Decoder
Convert reserved HTML characters, Unicode text, named entities, decimal references, and hexadecimal references in real time. The text stays in your browser.
Encode or decode character references
Choose an operation and scope; output updates immediately while you type.
| Character | Named reference | Decimal | Hexadecimal |
|---|---|---|---|
| & | & | & | & |
| < | < | < | < |
| > | > | > | > |
| " | " | " | " |
| ' | ' | ' | ' |
What HTML character references are
HTML uses characters such as less-than signs, greater-than signs, ampersands, and quotation marks as part of its markup syntax. When one of those characters should appear as text rather than syntax, a character reference can represent it. A reference begins with an ampersand and normally ends with a semicolon.
Named references use memorable identifiers such as & for an ampersand and < for a less-than sign. Numeric references identify a Unicode code point in decimal or hexadecimal, such as © or © for the copyright symbol. Browsers resolve these references while parsing HTML text.
Encoded text: <strong>Tom & Jerry</strong>
Choosing an encoding scope
Reserved HTML characters only
This is the practical default for displaying ordinary text inside an HTML text context. It replaces ampersand, less-than, greater-than, double quote, and apostrophe. Ampersand is processed first so newly created entity syntax is not encoded again during the same conversion.
Reserved plus non-ASCII
This mode also converts code points above ASCII to hexadecimal numeric references. It can be useful when working with a legacy transport or source file that expects ASCII-only text. Modern UTF-8 HTML normally supports Unicode directly, so encoding every accented letter or symbol is not required merely for browser display.
Every non-whitespace character
This diagnostic mode converts letters, digits, punctuation, and symbols to hexadecimal numeric references while keeping spaces and line breaks readable. The result is much longer and should not be treated as encryption or obfuscation. A browser can decode the references back to the same visible characters.
Encoding depends on context
Escaping HTML text is not the same as escaping an attribute, URL, CSS value, or JavaScript string. Data inserted between ordinary element tags has one set of risks; data inserted into an href, inline style, script, or event handler has different parsing rules. A generic encoder cannot make arbitrary untrusted data safe in every location.
Prefer a framework or template system that automatically escapes values for the correct output context. Use DOM APIs such as textContent when adding plain text. Avoid building markup by concatenating strings, and never use entity encoding as a substitute for URL validation, Content Security Policy, input validation, or safe JavaScript APIs.
Common mistakes
- Double encoding: encoding
&again produces&amp;, which displays the entity text rather than the intended ampersand after one parse. - Missing semicolons: browsers tolerate some historical forms, but complete references are clearer and less ambiguous.
- Assuming entities hide data: references are a representation, not encryption. Search engines, browsers, and developers can decode them.
- Using HTML escaping in JavaScript: JavaScript string and script contexts require different controls.
- Decoding untrusted markup and inserting it as HTML: this can restore active tags or attributes. Treat decoded output as text unless it has been sanitised for the destination.
Unicode and code points
JavaScript strings use UTF-16 internally, but this encoder iterates over Unicode code points so characters outside the Basic Multilingual Plane are emitted as one numeric reference rather than two surrogate references. Decoding relies on the browser’s HTML parser behavior. Visually identical text can still have different Unicode normalization forms, which this tool does not change.
Methodology and safety
Reserved encoding uses explicit replacements. Unicode and all-character modes iterate through code points and write hexadecimal numeric references. Decoding uses a detached textarea element, reading its text value rather than inserting decoded output into the live document as executable markup. Input and output are not sent to MiniUtils.
The decoder follows the current browser’s HTML entity support and error recovery. It is not an XML entity resolver and does not process custom document type definitions. HTML has a large named-reference table, while XML defines only a small built-in set unless a document declares more.
Frequently asked questions
Should I encode every Unicode character?
Usually no. UTF-8 supports international text directly. Encode reserved syntax where needed and retain readable Unicode unless a specific legacy requirement says otherwise.
Why does decoding reveal tags?
A sequence such as <script> represents literal angle brackets. Decoding restores those characters. Do not insert untrusted decoded text with innerHTML.
Does this prevent cross-site scripting?
Not universally. Correct output encoding is one defense, but it must match the destination context. Use trusted framework escaping and safe DOM APIs.
What is the difference between decimal and hexadecimal references?
They identify the same Unicode code point with different number systems. Hexadecimal begins with &#x; decimal begins with &#.
Can I decode several entities at once?
Yes. Mixed named, decimal, and hexadecimal references are decoded throughout the input in real time.
Is text stored?
No. Conversion occurs in the current browser session. Avoid confidential information on an untrusted device.
Reference
The HTML Living Standard named character references lists recognised names, while its parsing sections define how browsers consume character references and recover from malformed input.