Free tool HTML encoder and HTML entity decoder
Show a snippet of code on a page without the browser running it, or turn <, " and ' back into the characters they stand for. Decoding follows the HTML standard, including the cases browsers forgive.
- Escape or unescape
- Full named-entity table
- Runs locally
Escape or unescape HTML
The sample is a link you might want to show in a blog post as code. Try the second sample: a tracking snippet that a rich-text editor escaped, which is why it never ran.
Everything in the box is converted at once.
<a href="/pricing?plan=pro&utm_source=blog">See "Pro" plans & prices</a>Entities
10
Converted in this run.
Characters in
72
Characters out
112
Checks
Entities found
Each entity once, in order of appearance.
| Entity | Character | Code point | Count |
|---|---|---|---|
< | < | U+003C | 2 |
" | " | U+0022 | 4 |
& | & | U+0026 | 2 |
> | > | U+003E | 2 |
Share these inputs: the values go after the # in the link, so they never reach a server.
https://tapcub.com/tools/html-entity-encoder
Version v1.0Updated Update history
What the entities mean
An entity, properly a character reference, is a way to write a character that would otherwise be read as markup or could not be typed.
The five that matter
& starts an entity and < starts a tag, so both must be escaped in text. > is escaped for symmetry. Inside an attribute, escape the quote that delimits it: " or '.
Named or numeric
Named references such as © are easier to read. Numeric ones, © or ©, work for every character, including Chinese and emoji, which have no names.
Forgiving decoding
Browsers decode 106 old names such as & and © even without the semicolon, and read – as an en dash. The checks list each case so you can fix the source.
Double escaping
If the result still shows <, the text went through escaping twice, often once by an editor and once by a template. Decode again, then find where the extra step happens.
Escaping for HTML text is not the same as escaping for a URL, a JavaScript string or CSS. Each context has its own rules; use the URL encoder for links.
Three steps
Encode before code goes onto a page; decode when you need to read it.
-
1
Pick the mode
Encode to show code as text. Decode to read text full of
&…;. -
2
Choose the scope
For HTML pages, "Only & < > and quotes" is enough, since UTF-8 pages can carry any character. Numeric output suits old systems and email templates that mangle non-ASCII text.
-
3
Check the warnings
Missing semicolons, unknown names and double escaping are listed with line numbers, so you can fix the source rather than the symptom.
Common characters and their references
The HTML standard defines 2,231 named character references, 106 of which also work without a semicolon for historical reasons. Any character can also be written as a decimal or hex code point.
- Decoding takes the longest matching name:
∉is ∉, but¬it;is ¬ followed by "it;" �, surrogates and values above U+10FFFF become U+FFFD; 128–159 map to windows-1252 characters- This page uses the WHATWG values:
⟨is U+27E8, not U+2329 as in HTML 4 - Attribute values have one extra rule (no decoding before = or a letter) that this tool does not apply
| Character | Named | Decimal | Hex | Notes |
|---|---|---|---|---|
| & | & | & | & | Always escape in text |
| < | < | < | < | Always escape in text |
| > | > | > | > | Escaped by convention |
| " | " | " | " | In double-quoted attributes |
| ' | ' | ' | ' | ' is not in HTML 4 |
| (no-break space) | |   |   | Not equal to a normal space |
| © | © | © | © | Works without ; too |
| — | — | — | — | |
| 中 | — | 中 | 中 | No name; numeric only |
Six inputs browsers decode differently than you might expect
Each row was checked against Python’s html.unescape, which implements the same HTML5 rules.
| Input | Decodes to | Why |
|---|---|---|
&lt; | < | Escaped twice: one decode leaves an entity behind |
©2026 | ©2026 | Legacy name, semicolon optional |
¬it; | ¬it; | Longest match is the legacy name "not" |
– | – (U+2013) | 150 is a C1 control; HTML maps it via windows-1252 |
� | � (U+FFFD) | Null is never allowed |
⟨ | ⟨ (U+27E8) | HTML5 changed the value from HTML 4 |
Rows two to four are parse errors that browsers silently fix. A strict XML parser would reject them, which is why the same HTML can render in a browser yet break in an RSS reader or an email sender.
Where HTML escaping goes wrong
Most bugs are escaping too little, too much, or in the wrong place.
Pasting code into a rich-text editor
Visual editors escape what you paste, so <script> becomes <script> and shows as text. Tracking and chat snippets go into the HTML or custom code field instead.
Escaping twice
A template escapes a value that was already escaped, and readers see & on the page. Escape once, at output, and store raw text.
Assuming escaping stops all XSS
HTML escaping protects text and quoted attributes. It does not make a value safe inside href="javascript:…", a script block or an unquoted attribute.
Treating as a space
A no-break space copied from a web page into a campaign name or event name does not equal a space, so it splits rows in reports and fails exact-match filters.
A tracking snippet that actually runs
The most common reason a new analytics setup shows no data is a snippet that never executed. An escaped script tag is one way that happens.
One script for analytics and chat
A single async script, about 2 KB compressed. It goes before the closing head tag or into your site builder’s custom code field.
Learn moreRealtime confirms it
Open realtime visitors after installing: you should appear within about a minute of your first page load.
Learn moreData quality checks
Event names that differ only in case are flagged, so stray variants of a name are caught before they skew reports.
Learn moreHTML entity questions
Still have a question?
Chat with the team behind TapCub — we usually reply within a few hours on business days.
What is an HTML entity?
A character reference: text that starts with & and stands for one character. < is <, © is ©, 中 is 中. They let you write characters that would otherwise be read as markup, or that are hard to type.
Which characters must I escape in HTML?
In text, & and <; > is usually escaped as well. Inside an attribute value, also the quote character around it. On a UTF-8 page you do not need entities for accented letters, Chinese or emoji.
What is the difference between ' and '?
Both mean an apostrophe. ' comes from XML and was only added to HTML in HTML5, so very old HTML parsers do not know it. ' works everywhere, which is why this tool uses it.
Why does my tracking code show up as text on the page?
It was escaped, usually by a rich-text editor, so the browser received <script> instead of a tag. Decode it here to check, then paste the original into your site’s HTML, header code or custom code field, not the visual editor.
Does escaping HTML prevent XSS?
It is the right defence for values placed in HTML text and quoted attributes. It is not enough inside URLs, inline scripts, styles or event handler attributes, which each need their own encoding or, better, a templating system that escapes by context.
How many named entities are there?
The HTML standard lists 2,231 named character references. 2,125 are distinct names ending in a semicolon; the other 106 are legacy forms without it, such as &. Decoding here uses the whole list.
Is what I paste sent anywhere?
No. Everything runs in your browser. The share link stores the text after # in the address, which browsers do not send to servers, but anyone you give it to can read it.
Update history
New features, fixes and data refreshes for this tool, newest first.
-
· v1.0
LaunchedFirst release.
Missing something or found an error? Tell us — requests that come up often go into the next update. All tool updates
Install the script, then watch it work
One async script covers analytics and chat. Realtime visitors confirm it is running within about a minute.