How to use
- Choose Encode or Decode, and HTML or Unicode escapes.
- Paste your text. The result updates as you type.
- For HTML encoding, choose whether to escape only the five special characters or every non-ASCII character too.
- Copy the result.
Options explained
- Escape special characters
- Converts & < > " ' to entities. This is all a UTF-8 web page needs and keeps other characters readable.
- Also escape non-ASCII
- Turns every character outside ASCII into a numeric entity, for systems that cannot store UTF-8.
- Named entities
- Uses names such as © and where they exist, numeric entities otherwise.
- Unicode escapes
- \uXXXX for JavaScript and JSON (emoji become two escapes, a surrogate pair), \u{…} for modern JavaScript, U+XXXX to name code points, and &#…; as decimal HTML entities.
Common entities
| Character | Named | Numeric |
|---|---|---|
| & | & |
& |
| < | < |
< |
| > | > |
> |
| “ | " |
" |
| ’ | ' |
' |
| non-breaking space | |
  |
| © | © |
© |
| — | — |
— |
Frequently asked questions
Does escaping HTML protect against XSS?
Escaping text before inserting it into HTML element content is one essential defence. Attributes, URLs, JavaScript and CSS contexts need their own escaping rules, so use your framework's built-in escaping rather than doing it by hand.
What is the difference between and a normal space?
A non-breaking space (U+00A0) looks like a space but stops the browser from wrapping a line at that point, and several in a row are not collapsed.
Why does © without a semicolon still decode?
For historical reasons the HTML standard decodes some common entities even without the trailing semicolon. This decoder follows the same rules as browsers.
How do I show an emoji in JSON as an escape?
Choose Unicode escapes with \uXXXX. Emoji outside the Basic Multilingual Plane become two escapes, for example 😀 is 😀.
Privacy
This tool runs entirely in your browser. Your files and text are processed on your device and are never uploaded to our servers.