HTML entity encoder: escape special characters for HTML, free and private
An HTML entity encoder replaces characters that have a special meaning in HTML, such as <, > and &, with codes the browser shows as plain characters: <, > and &. To encode HTML entities free and privately, paste your text into Input Text and copy the result from HTML Entities Output, which updates as you type. Nothing is uploaded: the encoding runs in your browser, and you can confirm that in the Network tab of DevTools.
Five characters are always encoded: &, <, >, " and '. Everything else is left alone unless you tick Encode non-ASCII, which also converts ©, €, é, emoji and anything above character code 127 except the 27 control codes described under Windows-1252 safeguard below. The apostrophe is written ' in Named and Numeric modes and ' in Hex mode, because ' is not defined in HTML 4.
To reverse the process, paste the encoded text into the HTML entity decoder. Encoding prepares text for HTML only. For web addresses, the URL encoder applies percent-encoding instead.
Table of Use: input text and encoded output
| You type | Entity Type and options | You get |
|---|---|---|
| <b>"Tom's" & Co</b> | Named | <b>"Tom's" & Co</b> |
| <b>"Tom's" & Co</b> | Numeric | <b>"Tom's" & Co</b> |
| <b>"Tom's" & Co</b> | Hex | <b>"Tom's" & Co</b> |
| if (a < b && c > d) | Named | if (a < b && c > d) |
| Price: 5 € — café © | Named, Encode non-ASCII off (default) | Price: 5 € — café © |
| Price: 5 € — café © | Named, Encode non-ASCII ticked | Price: 5 € — café © |
| Price: 5 € — café © | Numeric, Encode non-ASCII ticked | Price: 5 € — café © |
| Price: 5 € — café © | Hex, Encode non-ASCII ticked | Price: 5 € — café © |
| Hi 😀 | Named, Encode non-ASCII ticked (no name exists) | Hi 😀 |
| Line 1: a / Line 2: b | Preserve line breaks unticked | a b (
 in Hex mode) |
| & | Any: already-encoded text is encoded again | &amp; |
After encoding a snippet, check how it will look with the HTML previewer. If you are writing a page in Markdown first, the Markdown to HTML converter produces the markup for you.
Features
- Encodes as you type. There is no Encode button; the output is recalculated on every change.
- Entity Type. Named (&), Numeric (&) or Hex (&), with a one-line hint under the buttons.
- Named mode uses HTML 4 names. Characters such as ©, é, € and — get a readable name; a character with no name falls back to a decimal reference.
- Encode non-ASCII. Off by default. Handles emoji as a single character, so 😀 becomes one reference.
- Preserve line breaks. On by default. Untick it to write each newline as (
 in Hex mode).
- Show Reference. A table of 20 common entities with the character, named, numeric and hex forms and a description.
- Windows-1252 safeguard. Browsers read 27 of the references € to Ÿ as other characters (€ shows as €), so with Encode non-ASCII ticked, those 27 invisible control characters are left unencoded, with a note telling you how many.
- Copy, Download and Clear. Download saves html-entities.txt.
- Counters. Characters and lines in, characters out, and the percentage increase.
It does not parse HTML: everything you paste is treated as text, so tags are encoded too. Spaces and tabs are never changed. To read a long snippet before or after encoding, the HTML beautifier indents markup, and the HTML minifier shrinks it.
How to encode HTML entities, step by step
- Paste or type your text into Input Text.
- Under Entity Type choose Named, Numeric or Hex. Named is the easiest to read; Numeric and Hex work for almost every character (the exceptions are listed in the FAQs below).
- Tick Encode non-ASCII only if the text may be shown somewhere that does not use UTF-8. Leave it off for ordinary web pages.
- Keep Preserve line breaks ticked for multi-line text, or untick it to get one unbroken line with newlines written as references.
- Read the result in HTML Entities Output. The line under it shows the number of extra characters.
- Click Show Reference if you want to look up a character, then Copy to put the output on your clipboard, Download to save html-entities.txt, or Clear to start over.
Who can use it
- Technical writers and bloggers who need code samples to display as text in a post or documentation page.
- Web developers escaping text for templates and attribute values, then testing the page in the HTML previewer. The meta tag generator escapes quotes on its own, so give it plain text.
- Email builders sending to clients that may not handle UTF-8, using Encode non-ASCII for symbols and accents.
- Developers working with XML or feeds, who can pick Numeric or Hex and tidy the file with the XML formatter.
- Data and API users preparing strings that sit inside JSON, after checking the structure with the JSON formatter.
- Students learning how character references map to Unicode code points, and to ASCII codes with the text to ASCII converter.
FAQs
How do I encode text as HTML entities?
Type or paste your text into Input Text. The encoded version appears in HTML Entities Output as you type: & becomes &, < becomes <, > becomes >, " becomes " and ' becomes '. Choose Named, Numeric or Hex under Entity Type to pick the style, then click Copy or Download.
How do I show HTML code as text on a web page?
Paste the snippet into Input Text, copy the output and place it in your page. The browser reads the entities as plain characters, so a tag such as the div tag is displayed as text instead of being run as markup. Because every <, > and & is encoded, the code shows as text. To keep its line breaks and indentation, wrap it in a pre element that contains a code element.
What is the difference between named, numeric and hex HTML entities?
All three give the same character. Named entities use a word (©) and are easiest to read, but only some characters have one. Numeric entities use the Unicode code point in decimal (©) and hex entities in hexadecimal (©); both work for almost every character, including emoji. Exceptions: � and the surrogate codes � to � show as the replacement character �, and 27 codes from € to Ÿ are read as Windows-1252 characters (€ shows €). In Named mode, unnamed characters become decimal references.
Do I need to encode non-ASCII characters like é, € or emoji?
No. Only the five characters &, <, >, double quote and apostrophe need encoding to be safe in HTML, and this tool always encodes them. Characters such as é, € and emoji display correctly on any page served as UTF-8. Tick Encode non-ASCII only when the text may end up somewhere that does not use UTF-8, such as an older email system.
Why does the encoder change text that already contains entities, such as &?
The tool treats your input as plain text, so every & is encoded, even one that already starts an entity: & becomes &amp; and © becomes &#169;. That is correct when you want to display entity code literally, but it double-encodes text that was already escaped. Encode your original text once, not the encoded version.
Can I use HTML entities in JavaScript or URLs?
Inside HTML, yes, including attribute values such as href, where & should be written &. Outside HTML, no: a .js file or a script block needs JavaScript escapes such as \u0026, and a raw URL needs percent-encoding, where & becomes %26. For XML, use Numeric or Hex, because XML predefines only five names.
Does encoding HTML entities prevent XSS?
Encoding & < > " and ' makes text safe to place in element content or in a quoted attribute value. It does not protect text placed inside a script or style block, in an unquoted attribute, or in a URL. In a live application, rely on your framework's output escaping rather than a manual step with this tool.
Is my text uploaded anywhere?
No. Encoding runs entirely in your browser, so the text you type is never uploaded or stored by ZipConvert. You can check this yourself by opening the Network tab in your browser DevTools while you type: no request carrying your text is sent.