Which characters get encoded?

Encoding always escapes the markup-critical characters ampersand, less-than, greater-than, double quote, and single quote. A wider table of named entities such as copyright, non-breaking space, and accented letters is also applied so the output is display-safe.

Why must the ampersand be encoded first?

Because every entity begins with an ampersand, it must be replaced before any other character. If it were not, encoding the less-than sign would produce text starting with an ampersand that a later pass would wrongly re-escape, corrupting the output.

Does decoding handle entities not in the table?

This tool decodes the named entities it knows plus numeric entities in decimal and hexadecimal form. Unknown named entities are left untouched so no data is silently lost; use the numeric tool if you need every reference decoded.

What is the difference between ' and '?

Both represent a single quote. The named form ' is valid in HTML5 and XML but not in older HTML4, where ' is the safe choice. Encoding here uses the numeric ' for the apostrophe for maximum compatibility.

Is named encoding enough to prevent XSS?

Escaping the five markup characters stops most injection in HTML text contexts, but attribute and script contexts need extra care. Treat this as a display helper, not a substitute for a context-aware templating engine on the server.

What is the HTML Named Entity Encoder/Decoder?

Encode and decode HTML using W3C named character references such as &, <, >, ", © and . Make markup safe to display, or turn entities back into plain text. Runs entirely in your browser. It runs free in your browser on Gera Tools, with nothing uploaded.

HTML Named Entity Encoder/Decoder

Name: HTML Named Entity Encoder/Decoder
Creator: Gera Tools
License: https://creativecommons.org/licenses/by/4.0/

Get one useful tool a week

Like this tool? Enter your email and we'll send you one genuinely useful Gera tool a week — plus a link to come back to this one. No spam, one-click unsubscribe any time.

HTML named entities let you show characters that would otherwise be interpreted as markup. This tool escapes the critical characters and a useful table of common symbols into their &name; form, and decodes them back to plain text.

When you need this

The three most common reasons to encode HTML entities:

Displaying user content safely: if a comment field might contain <script> text that you want to show on a page rather than execute, encoding the angle brackets neutralises it for display (though a server-side sanitiser remains essential).
Writing HTML inside HTML: a code blog post about <div> tags needs <div> so the browser renders the angle brackets instead of parsing them.
Embedding special symbols: copyright ©, em dash —, non-breaking space, and accented letters can be encoded to ensure they survive character-encoding mismatches in older email clients or XML pipelines.

Decoding is useful when a CMS or API returns entity-encoded text (&amp;, <h1>) that you need to read or process as plain text.

How it works

Encoding replaces the ampersand first, then the remaining special characters, so no escape sequence is ever double-processed:

& -> &amp;
< -> &lt;
> -> &gt;
" -> &quot;
' -> &#39;
© -> &copy;     (non-breaking space) -> &nbsp;

The ampersand-first rule is critical: if you encoded < before &, you would produce < — then a second pass over the ampersand would corrupt that into &lt;.

Decoding scans for &...; references, looks each named entity up in the table, and also expands numeric references such as   and   so mixed input is handled cleanly.

Worked examples

Example 1 — encoding a user comment: Input: <b>Great article</b> & thanks! Encoded: <b>Great article</b> & thanks! The browser now displays the angle brackets literally instead of parsing them as a bold tag.

Tips and notes

Always encode the ampersand before any other character — the most common bug in hand-rolled escapers.
When placing user text inside an HTML attribute, double quotes must be escaped ("), which this tool does.
For XML content, prefer a dedicated XML escaper: XML only recognises five standard entity names (& < > " ') and rejects the hundreds of HTML-only named entities like © and  .
Named encoding is a display helper, not a substitute for context-aware server-side sanitisation or a trusted HTML parser when rendering user-supplied markup.