Are named entities safer than numeric ones?

Not by themselves. Numeric entities (A) are always valid in HTML and XML, while named ones (Å) must be in the language’s table. XML-based content, like SVG attributes, only accepts five named entities: amp, lt, gt, quot, apos. Use numeric ones when in doubt.

Should I encode every character?

No. With UTF-8 only &, and optionally " and ' need to be escaped for safe HTML. Over-encoding inflates file size and makes the source unreadable.

What is the difference between å and å?

No visible difference. The first is decimal notation, the second hexadecimal, both point to the same Unicode code point (U+00E5, "å"). Use whichever you find easier to read.

Does this protect against XSS?

Partly. Escaping , &, ", ' protects against injection in text content and attributes, but not inside blocks, JavaScript strings or URL contexts. Use context-aware helpers (Astro, React, DOMPurify) in production.

HTML Entities Encoder and Decoder

How it works

Enter text and choose "To entities" to turn special characters like &, <, >, " and ' plus non-ASCII characters into HTML entities, or "From entities" to decode them back to plain text. Handy for safely showing code or special characters in HTML. Everything happens locally in your browser.

About this tool

HTML entities are special codes that let you display characters that would otherwise confuse the browser, such as < for "less than", & for the ampersand, or ø for the letter ø in older ASCII-based contexts. They are also used for emoji, mathematical symbols and typographic niceties that are not on the keyboard. This tool encodes and decodes in both directions: paste raw text to get the entity version, or paste encoded text to get the readable form back. Everything runs in the browser.

How to use it

Paste the text into the "Raw text" field to encode, or into the "HTML" field to decode.
Choose whether to use named entities (å) or numeric ones (å / å).
Copy the result with one click from the opposite field.
Use "escape dangerous only" to keep letters like "æøå" and only escape <, >, &, ", '.

Examples

Common code example

Input<div class="x">Hi & safe travels!</div>

Output<div class="x">Hi & safe travels!</div>

Norwegian letters

Inputæøå

Outputæøå

If the page uses UTF-8 and a correct Content-Type, you don’t need to encode æøå. Encode only <, >, &, " and ' to prevent XSS.

Common use cases

Safely insert user input into HTML without XSS risk.
Paste source code into a blog post or wiki without the tags rendering.
Handle special characters in email templates that must be ASCII-safe.
Decode content copied from a "view source" listing.
Show maths (∑, π), arrows (←, →) and currency (€, £) regardless of font.

Frequently asked questions

Are named entities safer than numeric ones?: Not by themselves. Numeric entities (A) are always valid in HTML and XML, while named ones (Å) must be in the language’s table. XML-based content, like SVG attributes, only accepts five named entities: amp, lt, gt, quot, apos. Use numeric ones when in doubt.
Should I encode every character?: No. With UTF-8 only &, <, > and optionally " and ' need to be escaped for safe HTML. Over-encoding inflates file size and makes the source unreadable.
What is the difference between å and å?: No visible difference. The first is decimal notation, the second hexadecimal, both point to the same Unicode code point (U+00E5, "å"). Use whichever you find easier to read.
Does this protect against XSS?: Partly. Escaping <, >, &, ", ' protects against injection in text content and attributes, but not inside <script> blocks, JavaScript strings or URL contexts. Use context-aware helpers (Astro, React, DOMPurify) in production.

Technical background

The HTML5 specification defines around 2,200 named entities, inherited from SGML and XHTML. A named entity is "&" + name + ";" (e.g. &), a numeric one is "&#" + decimal + ";" (&), a hexadecimal one is "&#x" + hex + ";" (&). All refer to Unicode code points. The parser recognises references when "&" is followed by valid characters before the next ";", with a special "named character reference" table for shortcuts. Only five entities are mandatory in XML (and thus SVG/XHTML): &, <, >, ", '. HTML5 allows the semicolon to be omitted for some legacy entities (&amp = &), but it is always safer to include it. From a security angle, context-aware escaping matters more than blanket-encoding all special characters: a value going into a URL must be URL-encoded, into an attribute HTML-encoded, into a JavaScript string JS-escaped.