HTML entities, read as a browser reads them.
Escape text for HTML with named, decimal or hex character references, or decode them as a browser does, with HTML's full list of names.
By Suraj KumarUpdated 3 min read
Text put into a page must have its & < > " and ' written as character references, or it becomes markup. Reading references back has its own rules, older than most of the web, that browsers still follow.
Escape, or read back.
Open the HTML entity encoder and type text: only what must be escaped is, unless you ask for everything outside ASCII or every character that has a name. References are written by name where there is one (é), or as decimal or hex numbers.
The rules browsers keep.
Decoding uses HTML's own list of 2,231 names and its tokenizer's rules: the longest name that matches, some old names without their semicolon (© 2026), and in an attribute's value a name followed by = or a letter left alone, so links like ?a=1©=2 survive. Numbers that name nothing, a surrogate or a C1 control are replaced as browsers replace them. The notes say what was irregular.
Nothing leaves your browser.
Everything is worked out on your device: what you paste or open is never sent anywhere, and nothing is kept when you leave. A share link carries what you typed after the #, which browsers never send to a server.
Further reading
Topics: html entities · html encode · html decode · html escape · unescape html · nbsp · character reference
A little less theory. A little more doing.
Try it on your own terms, with a free browser tool.
Try the tool