HTML Entity Encode
Runs 100% in your browserEncode HTML-sensitive characters and Unicode text as named, decimal, or hexadecimal entities. Preview safe source, copy or download output, and keep every conversion private in your browser.
Encode and decode HTML entities
Escape markup-sensitive characters as named, decimal, or hexadecimal entities — or decode them back to readable text. Runs entirely in your browser.
Input text
Entity settings
Output
Decoded text preview
Rendered as text, not live markupHTML source preview
Escaped source viewNothing to preview yet.
Entity conversion uses browser APIs only. Input is not uploaded, stored in localStorage, or interpreted as executable page markup.
Recent conversions
Recent conversions disappear when this page closes.
Frequently asked questions
An HTML encoder converts characters that have special meaning in HTML — such as ampersand, less-than, greater-than, and quotes — into character references such as & and <. This makes the characters representable as safe text rather than executable markup in the appropriate HTML context.
The five characters most commonly requiring HTML encoding in text and attribute contexts are ampersand (&), less-than (<), greater-than (>), double quote ("), and apostrophe (single quote). The exact escaping requirement depends on the HTML context: whether you are writing text content, an attribute value, or a script data block.
Named entities use a human-readable name such as & and ©. Decimal numeric references use a Unicode code point as a decimal integer, such as ©. Hexadecimal references use a hexadecimal code point, such as ©. All three represent the same character but in different notations. Named entities are only available for characters that have an assigned name in the HTML specification.
Yes. The decimal and hexadecimal encoding styles convert any Unicode character — including accented letters, CJK characters, currency symbols, and emoji — to a numeric reference such as 🚀. This is useful for ensuring source compatibility in ASCII-only environments or controlled output formats.
Critical mode only encodes the five markup-sensitive characters: &, <, >, and optionally quotes according to your quote-handling setting. All other ASCII and Unicode characters are passed through unchanged. This is the minimal encoding required to safely represent arbitrary text inside an HTML element or attribute.
Use the quote-handling selector to choose whether to encode both single and double quotes, only double quotes, only apostrophes, or keep all quotes literal. Inside a double-quoted attribute value you need to encode double quotes but not apostrophes. Inside a single-quoted attribute you need to encode apostrophes. In most modern HTML the double-quote rule applies.
No. HTML entities represent characters in HTML text or attribute contexts, while URL percent-encoding represents bytes in URL paths and query parameters. Use a dedicated URL encoder for query string values and path segments — applying HTML encoding to a URL will break it.
HTML encoding can be an important part of output handling, but a single generic encoder is not a complete XSS defence. Secure applications use context-appropriate output encoding, safe DOM APIs such as textContent instead of innerHTML, trusted sanitization for user-provided HTML, and framework protections. Never rely on this tool alone for a security review.
No. All encoding runs in your browser using JavaScript string operations and Unicode code-point arithmetic. The page makes no network calls, writes nothing to localStorage, and produces no server logs. The conversion history disappears when you close the page.
Yes. The output is placed in a read-only textarea and a source preview element, so tags appear as escaped text rather than executing or rendering as live page markup. The text preview shows what the encoded output decodes back to, without injecting it into the DOM.
Place the encoded output in the intended context and test it with the same rendering and security rules used by your application. Encoding is context-sensitive: values intended for use in JavaScript strings, CSS, URLs, SQL, or JSON each need their own context-specific escaping strategy on top of or instead of HTML encoding.
Yes. Use the paired HTML Entity Decode route or switch to the Decode tab in the workspace. A decode-then-encode round trip is useful for checking how a value is represented, but be aware that repeated encoding may produce double-encoded entities if the source already contained character references.
What is HTML Entity Encode?
An HTML Entity Encoder converts characters that have a special meaning in HTML into character references, making them safe to represent as text rather than markup. The five characters that almost always need encoding are ampersand (&), less-than (<), greater-than (>), double quote ("), and apostrophe ('). Beyond those critical five, the encoder can also convert Unicode characters — including accented letters, currency symbols, mathematical operators, arrows, typographic punctuation, and emoji — into decimal or hexadecimal numeric references such as é and 🚀.
HTML entity encoding matters in several distinct contexts. In text content between tags, you need to encode &, <, and > to prevent the browser from interpreting them as markup. Inside a double-quoted attribute value you additionally need to encode ". Inside a single-quoted attribute value you need to encode '. In older or more restrictive environments — such as XML, email HTML, or templates that must work without a declared charset — encoding every non-ASCII character as a numeric reference removes ambiguity entirely.
Four encoding styles for every workflow
Critical character mode converts only the five markup-sensitive characters, leaving all other ASCII and Unicode content unchanged. This is the minimum safe encoding for inserting arbitrary text into an HTML context.
Named entity mode converts all characters that have an assigned HTML name — ampersand becomes &, copyright becomes ©, em-dash becomes —, euro becomes € — and falls back to decimal references for characters with no assigned name. Named entities are human-readable and well-supported in all browsers.
Decimal numeric mode converts every critical character and every non-ASCII character to a decimal reference such as é. This guarantees that the output contains only printable ASCII characters, which is useful for environments with character-set constraints.
Hexadecimal numeric mode does the same using base-16 code points such as é. Some style guides prefer hex references because they align with Unicode code-point notation in JavaScript (\u00E9) and CSS (\00E9).
Quote handling for attribute contexts
The quote-handling selector lets you choose whether to encode both quote characters, only double quotes (for value="..." attributes), only apostrophes (for value='...' attributes), or keep quotes unchanged (when you are only encoding text content). Encoding only the relevant quote reduces unnecessary entity bloat in the output.
Why output security guidance matters
HTML encoding is context-sensitive. Encoding for text content is different from encoding for an attribute value, a <script> block, a <style> block, a URL in an href attribute, or a JSON payload. A single global encoder is not a complete XSS defence. ToolsSonic's encoder labels its output with context guidance and links to the paired Decoder — so you can round-trip test your output and understand its limits before using it in a production application.
Why ToolsSonic HTML Encoder beats competitors
Most online HTML encoders — htmlentities.com, htmlescape.net, and character-encoder.com — offer a single textarea with one encoding button and no options. ToolsSonic's encoder provides four encoding styles, four quote-handling modes, live conversion, Unicode and emoji support, input and output character counts, entity counts, byte-size delta, a dual preview panel that shows decoded text and escaped source without executing anything, copy output, download .txt, swap back to input, and a memory-only session history. Every byte of processing runs in the browser — nothing is uploaded to a server.
Common use cases
- Escaping user-submitted text before inserting it into an HTML context
- Preparing HTML code samples for documentation that must display as source, not render
- Encoding accented characters and emoji as numeric references for ASCII-safe output
- Checking correct quote encoding for double-quoted and single-quoted HTML attributes
- Encoding template variables before interpolation into an HTML email or CMS template
- Converting named entities to decimal references for XML or XHTML compatibility
- Round-trip testing: encode then decode to verify your encoding scheme is lossless
- Generating HTML entity cheat sheets for teaching or code review
Why use ToolsSonic's HTML Entity Encode?
ToolsSonic's HTML Entity Encoder provides four encoding styles (critical, named, decimal, hex), four quote-handling modes, live conversion toggle, Unicode and emoji numeric reference support, entity count and byte-size statistics, dual non-executable preview panels (decoded text + escaped source), copy output, download, swap, session-only history, and explicit security context guidance — all without uploading a single character to a server. It is the most complete free HTML entity encoder available in a browser.
Related tools
HTML Entity Decode
Editor's choiceDecode named, decimal, and hexadecimal HTML entities back to readable text. Inspect entity counts, preview source safely, and copy or download decoded output locally.
URL Encoder
Editor's choiceEncode URL components, query values, path segments, form data, or complete URIs locally with UTF-8 percent encoding, + space handling, delimiter preservation, and a URL analyzer.
Base64 Encode
Editor's choiceEncode UTF-8 text and local files to standard or URL-safe Base64 with optional padding, line wrapping, Data URI prefixes, byte statistics, and browser-only processing.
HTML Editor
Editor's choiceEdit HTML with a live preview — synchronized source editor, WYSIWYG visual pane, sandboxed preview, 5 starter templates, format, minify, validate, find/replace, file import, and download. 100% in your browser.
JSON Escape / Unescape
Editor's choiceEscape raw text for a JSON string or unescape JSON string content back to readable text. Handle quotes, backslashes, control characters, Unicode, line breaks, tabs, and optional slash escaping privately in your browser.