EscapeHTMLEvery special character, safely escaped.
Paste raw text or markup and get perfectly escaped entities — or paste an entity string and get the original characters back. Named, decimal and hex styles, full Unicode coverage, zero uploads.
- 100% client-side — nothing uploaded
- Free, no sign-up
- Auto-detects direction
// Output appears here — start typing or paste on the left.A checkpoint for every character
Built for developers who render user input and for anyone who ships multilingual email.
Three Entity Styles
Named entities for readability, decimal for legacy mail systems, hex for URLs and JavaScript — switch styles with one click and compare instantly.
Unicode Lossless
Turn on the Non-ASCII option and Chinese, Arabic, Cyrillic or emoji become numeric code points like 你 — text survives any transport, UTF-8 or not.
XSS-Safe by Default
The five critical characters & < > " ' are escaped first, so injected markup becomes inert text before it ever reaches the DOM.
HTML entities cheat sheet
The five characters that must be escaped, in every style the tool supports.
&&&<<<>>>"""'''built for the moments before you ship
Paste a string containing ampersands, angle brackets, or quotes and this tool converts them into the exact entity format your target context expects. It serves developers preparing template literals, content managers pasting multilingual text into CMS fields, and QA engineers verifying that user-generated input renders as visible text rather than executable markup. The encoder handles Non-ASCII characters like 你 alongside standard punctuation, so a single paste covers both ASCII symbols and CJK or accented characters without a second pass through a separate converter.
from pasted text to entity-safe output
- Paste or type your raw text into the input area, or click Sample to load a demonstration string.
- Tick Escape quotes if your output needs single and double quotes converted to their respective entities.
- Press Encode to transform the input, or click Auto to let the tool detect and apply the correct direction.
- Switch between Named, Dec, and Hex to choose the entity notation style used in the result.
- Review the output panel, then click Copy Output to place the encoded text on your clipboard.
Frequently Asked Questions
How do I encode HTML entities?
Paste or type your text into the left pane. EscapeHTML encodes it instantly — ampersands, angle brackets and quotes become entities such as & < > ". Pick the Named, Decimal or Hex style in the toolbar, then click Copy Output.
How do I decode HTML entities back to text?
Paste the encoded string (for example "Tom & Jerry") into the input pane. Auto mode detects the entity pattern and decodes it to plain text immediately. You can also force decoding with the Encode / Decode switch.
What is the difference between named, decimal and hex entities?
Named entities use readable words like & and <. Decimal entities use the character's code point in base 10, like &. Hex entities use base 16 with an x, like &. All three render identically in browsers — hex is common in URLs and JavaScript, decimal in older email systems.
How does the auto-detect mode work?
Auto mode scans the input for entity patterns such as {, 你 or <. If entities outnumber the raw special characters, the input is treated as encoded text and is decoded; otherwise it is treated as raw text and is encoded.
How are non-ASCII characters like Chinese handled?
Enable the Non-ASCII option and every character above code point 127 — including Chinese, Japanese, Korean, Arabic and emoji — is converted to a numeric entity such as 你 for 你. This keeps multilingual text lossless across systems that are not UTF-8 safe, such as some email template engines.
Does escaping HTML prevent XSS attacks?
Encoding the five critical characters & < > " ' before rendering user input is the core defense against reflected and stored XSS: it turns active markup like <script> into inert text. Always escape on output in the context where the data will be rendered, and combine it with a Content Security Policy.
Is my text uploaded to a server?
No. The entire encoder and decoder runs in your browser with client-side JavaScript. Nothing you paste is transmitted, logged or stored, so the tool is safe for private source code, customer data and email templates.
Can I use entities in email templates?
Yes. Email clients are stricter than browsers — some strip or misread raw special characters. Encoding them as entities (and turning non-ASCII characters into numeric code points) keeps symbols, quotes and CJK text intact across Outlook, Gmail and Apple Mail.
The entities you actually type
Every entry gives the character, its named form, the decimal and hexadecimal equivalents, and what this encoder emits for it — which is not always the named form you expect.