Skip to content
PithLab

↑↓ to move · Enter to open · Esc to close

HTML Entity Encoder and Decoder

Escape and unescape HTML entities, named and numeric.

Use via API

Escape text as HTML entities, or decode named (&), decimal (&) and hex (&) character references back to text. Send JSON, get JSON back.

POST https://pithlab.com/api/v1/tools/html-entity-encoder-decoder

curl https://pithlab.com/api/v1/tools/html-entity-encoder-decoder \
  -H "Authorization: Bearer $PITHLAB_KEY" \
  -H "Content-Type: application/json" \
  -d '{"input":"<a href=\"/\">Café & Co</a>","mode":"encode","encoding":"named"}'

Fields and responseOpenAPI documentGet an API key

About the HTML Entity Encoder/Decoder

Escape text for safe use in HTML, or decode entities like &amp;, &copy; and &#x1F600; back to characters. Optional named or numeric encoding of non-ASCII text.

How to use the HTML Entity Encoder/Decoder

  1. Choose Encode or Decode.
  2. Type or paste your text. The result updates as you type.
  3. When encoding, choose whether to escape only the HTML-special characters or also every non-ASCII character.
  4. Copy the result or use Swap to send it back the other way.

Examples

Escape a snippet of HTML

Input

<a href="/search?q=fish&chips">Fish & Chips</a>

Output

&lt;a href=&quot;/search?q=fish&amp;chips&quot;&gt;Fish &amp; Chips&lt;/a&gt;
Decode named and numeric entities

Input

&copy; 2026 &ndash; caf&eacute; &#x1F600;

Output

© 2026 – café 😀

Frequently asked questions

Which characters must be escaped in HTML?

In element content, & and < are the ones that matter, and > is escaped by convention. Inside attribute values you must also escape the quote character used to delimit the value. The basic mode escapes all five of & < > " ' so the output is safe in both places.

Does escaping make user input safe to insert anywhere?

No. Entity encoding protects HTML text and quoted attributes, but not URLs in href, inline JavaScript, CSS or unquoted attributes, which each need their own escaping. Use your framework's built-in escaping where possible.

Which named entities can it decode?

All 252 named entities from HTML 4 plus &apos;, which covers the ones in common use, and every decimal or hexadecimal reference. Rarer HTML5-only names such as &check; are left unchanged and listed so you can spot them.

Do I need entities for accented letters or emoji?

Not if your page is served as UTF-8, which almost all are. Encoding non-ASCII characters is only useful for systems that mangle anything outside ASCII.