# HTML Entities Encoder and Decoder - Named, Decimal and Hex Page: https://hirantha.me/tools/html-entities-encoder Part of: Hirantha Sandaruwan Lakshan free tools (https://hirantha.me/tools) Updated: 2026-10-13 Encode text to HTML entities as names, decimal or hex and decode them back, with all 2,125 named references of the HTML standard and a table of the common ones. This is a free tool that runs in the browser: open the page to use it. File tools process files on the visitor's own device; files are never uploaded or stored. No account, sign-up, payment or watermark. Turn text into HTML entities, or decode entities back into text. Encode only the five characters that matter in HTML (& < > " '), every non-ASCII character, or everything, as a name such as é where the HTML standard has one and as a decimal or hexadecimal number where it does not. The decoder knows all 2,125 named references in the standard plus decimal and hexadecimal numbers, and it never hands the text to a browser parser, so nothing in it can run. What an entity is. A character reference starts with an ampersand and ends with a semicolon, and stands for one or two characters. It can be a name (©), a decimal number (©) or a hexadecimal number (©). All three mean the same character, U+00A9. You need them to show a literal < or & in HTML, and they let you write characters that your keyboard or your file encoding cannot. Which characters to escape. In text between tags, & and < must be escaped, and > is escaped by habit. Inside a double-quoted attribute value the double quote must be escaped too, and the apostrophe inside a single-quoted one. OWASP's cross-site scripting guidance lists these same five characters. The apostrophe is written ' by default, because ' is not defined in HTML 4. Tick the box if you want ', which HTML 5 and XML accept. Choosing names. When a character has several names, the encoder prefers its HTML 4 name, so … rather than … and   rather than  , and otherwise takes the shortest. A character with no name gets a number. Outside the five specials, names are only used for non-ASCII characters. The everything option writes letters and digits as numbers too, which is rarely useful beyond tests and obfuscation, and it adds no security. How decoding works. The decoder follows the HTML standard's tokenizer rules for text. Names are case sensitive, so É is a capital E with an acute and é is a small one. A reference with no semicolon still decodes if it is a number, or one of the 106 legacy names such as © and &, using the longest legacy name that fits. So ¬it; gives the not sign followed by it;, which is the standard's own example. Numbers follow the standard too: 0, surrogates and values above U+10FFFF become U+FFFD, and most of 128 to 159 map to the Windows-1252 characters, so € is the euro sign. Tick Strict to require the semicolon. The table and its limits. The decoder uses the full list of the HTML standard, taken from its entities.json on 2026-10-13: 2,125 names that end in a semicolon and 106 legacy names that work without one, 2,231 entries in all. The standard says the list is static and will not change. Decoding happens once, so &lt; becomes < and not <. Names that are not in the list are left as typed and shown in a warning. A few names stand for two characters, such as ≂̸. They decode correctly but are never chosen when encoding, because the encoder works one character at a time. Common HTML entities, with code points from the WHATWG HTML Standard: | Entity | Character | Code point | Use | | --- | --- | --- | --- | | & | & | U+0026 | Ampersand, must be escaped | | < | < | U+003C | Less-than sign, must be escaped | | > | > | U+003E | Greater-than sign | | " | " | U+0022 | Double quotation mark | | ' | ' | U+0027 | Apostrophe (HTML 5 and XML; ' works everywhere) | |   | (no-break space) | U+00A0 | No-break space | | © | © | U+00A9 | Copyright sign | | ® | ® | U+00AE | Registered sign | | ™ | ™ | U+2122 | Trade mark sign | | € | € | U+20AC | Euro sign | | £ | £ | U+00A3 | Pound sign | | ¥ | ¥ | U+00A5 | Yen sign | | ¢ | ¢ | U+00A2 | Cent sign | | § | § | U+00A7 | Section sign | | ¶ | ¶ | U+00B6 | Paragraph sign | | ° | ° | U+00B0 | Degree sign | | ± | ± | U+00B1 | Plus-minus sign | | × | × | U+00D7 | Multiplication sign | | ÷ | ÷ | U+00F7 | Division sign | | ½ | ½ | U+00BD | One half | | ¼ | ¼ | U+00BC | One quarter | | ¾ | ¾ | U+00BE | Three quarters | | · | · | U+00B7 | Middle dot | | • | • | U+2022 | Bullet | | … | … | U+2026 | Horizontal ellipsis | | – | (en dash) | U+2013 | En dash | | — | (em dash) | U+2014 | Em dash | | ‘ | ‘ | U+2018 | Left single quotation mark | | ’ | ’ | U+2019 | Right single quotation mark, also the typographic apostrophe | | “ | “ | U+201C | Left double quotation mark | | ” | ” | U+201D | Right double quotation mark | | « | « | U+00AB | Left double angle quotation mark | | » | » | U+00BB | Right double angle quotation mark | | ← | ← | U+2190 | Leftwards arrow | | → | → | U+2192 | Rightwards arrow | | ↑ | ↑ | U+2191 | Upwards arrow | | ↓ | ↓ | U+2193 | Downwards arrow | | ♥ | ♥ | U+2665 | Black heart suit | | ✓ | ✓ | U+2713 | Check mark | | ∞ | ∞ | U+221E | Lemniscate (infinity symbol) | | ≠ | ≠ | U+2260 | Not equal to | | ≤ | ≤ | U+2264 | Less-than or equal to | | ≥ | ≥ | U+2265 | Greater-than or equal to | | ­ | (soft hyphen) | U+00AD | Soft hyphen, invisible unless a line breaks there | | é | é | U+00E9 | Latin small letter e with acute | Q: What is the difference between & and &? A: None. Both are the ampersand, U+0026: the first by name and the second by its decimal number. & is the same character in hexadecimal. A browser treats all three identically. Q: Do I need to encode non-ASCII characters in HTML? A: Not if the page is served as UTF-8, which is the default today: the characters can be written directly. Entities help when the file encoding is unknown, when you want the source to stay plain ASCII, or when a character is hard to type. Q: Is ' valid? A: It is valid in HTML 5 and XML, but HTML 4 did not define it, and very old browsers ignore it. ' works everywhere, so the tool uses that unless you tick the box. Q: Does decoding run scripts or load images in the text? A: No. The decoder is plain string code. It never gives the text to a browser parser, never sets innerHTML and never creates elements, so a string such as is only ever text. Q: Why does © 2026 decode without a semicolon? A: Browsers accept 106 legacy names, such as copy, amp and lt, without the closing semicolon, for compatibility with very old pages. The HTML standard calls it a parse error but still decodes it. Tick Strict to require the semicolon. Q: How do I write a non-breaking space? A: Use   or  . It looks like a space, but a line will not break there, and several in a row are not collapsed into one the way ordinary spaces are in HTML. Q: Are entity names case sensitive? A: Yes. É is E with an acute accent and é is e with an acute accent. Some names exist in both cases with a different meaning, so copy the case exactly. Sources: Named character references, WHATWG HTML Standard (https://html.spec.whatwg.org/multipage/named-characters.html); Tokenization: numeric character reference end state, WHATWG HTML Standard (https://html.spec.whatwg.org/multipage/parsing.html#numeric-character-reference-end-state); Character entity references in HTML 4 (252 entities, no apos), W3C (https://www.w3.org/TR/html4/sgml/entities.html); Cross Site Scripting Prevention Cheat Sheet, OWASP (https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) Related tools: - [URL encode & decode](https://hirantha.me/tools/url-encoder.md): Percent-encode text for a URL, or decode it back. - [Base64 encode & decode](https://hirantha.me/tools/base64.md): Convert text to Base64 and back, right in your browser. - [Markdown previewer](https://hirantha.me/tools/markdown-previewer.md): Type Markdown and see it rendered live: headings, lists, tables, task lists, links and code. A small safe parser, copy as HTML, nothing uploaded. - [JSON formatter & validator](https://hirantha.me/tools/json-formatter.md): Pretty-print, minify, and validate JSON with clear error locations.