HTML Entities Encoder and Decoder - Named, Decimal and Hex

What an entity is. A character reference starts with an ampersand and ends with a semicolon, and stands for one or two characters. It can be a name (&copy;), a decimal number (&#169;) or a hexadecimal number (&#xA9;). All three mean the same character, U+00A9. You need them to show a literal < or & in HTML, and they let you write characters that your keyboard or your file encoding cannot.

Which characters to escape. In text between tags, & and < must be escaped, and > is escaped by habit. Inside a double-quoted attribute value the double quote must be escaped too, and the apostrophe inside a single-quoted one. OWASP's cross-site scripting guidance lists these same five characters. The apostrophe is written &#39; by default, because &apos; is not defined in HTML 4. Tick the box if you want &apos;, which HTML 5 and XML accept.

Choosing names. When a character has several names, the encoder prefers its HTML 4 name, so &hellip; rather than &mldr; and &nbsp; rather than &NonBreakingSpace;, and otherwise takes the shortest. A character with no name gets a number. Outside the five specials, names are only used for non-ASCII characters. The everything option writes letters and digits as numbers too, which is rarely useful beyond tests and obfuscation, and it adds no security.

How decoding works. The decoder follows the HTML standard's tokenizer rules for text. Names are case sensitive, so &Eacute; is a capital E with an acute and &eacute; is a small one. A reference with no semicolon still decodes if it is a number, or one of the 106 legacy names such as &copy and &amp, using the longest legacy name that fits. So &notit; gives the not sign followed by it;, which is the standard's own example. Numbers follow the standard too: 0, surrogates and values above U+10FFFF become U+FFFD, and most of 128 to 159 map to the Windows-1252 characters, so &#128; is the euro sign. Tick Strict to require the semicolon.

The table and its limits. The decoder uses the full list of the HTML standard, taken from its entities.json on 2026-10-13: 2,125 names that end in a semicolon and 106 legacy names that work without one, 2,231 entries in all. The standard says the list is static and will not change. Decoding happens once, so &amp;lt; becomes &lt; and not <. Names that are not in the list are left as typed and shown in a warning. A few names stand for two characters, such as &NotEqualTilde;. They decode correctly but are never chosen when encoding, because the encoder works one character at a time.