HTML Entities Explained: How to Escape HTML Characters

🔣Free HTML Entity Encoder / Decoder
Escape and unescape HTML characters.Open tool →

The characters that matter

The ampersand, the less-than and greater-than signs, and quotation marks inside attributes. Written raw, a browser may treat them as the start of a tag or the end of an attribute.

Why it matters for security

If a site shows user-typed text without escaping it, an attacker can insert a script that runs in other visitors' browsers – cross-site scripting. Escaping output is the basic defence.

Named and numeric entities

Common characters have names (copy for the copyright sign, nbsp for a non-breaking space). Any character can also be written by number.

Encode or decode

Paste text into the HTML Entity Encoder to escape it, or paste encoded text into the lower box to read it normally.

Frequently asked questions

Do I need to escape accented letters?

No, if your page is UTF-8.

Why do I see ampersand codes in my text?

It was encoded twice – decode it once.

Is escaping the same as URL encoding?

No. Use the URL Encoder for links.