HTML Entity Converter

Five characters that matter and two thousand that do not

HTML lets every character be written as a reference, and almost none of them need it. The exceptions are the ones a parser acts on: an ampersand, a less-than sign, a greater-than sign and the two quotation marks. Escape those and text stays text. The dashes, arrows, accented letters and card suits are a typing convenience, not a safety measure.

This converter goes both ways: the five alone, a name for every character that has one, or decimal or hexadecimal references throughout — and it reads all three forms back to plain text.

Which escape belongs in which position

The right answer depends on where the text lands, and the differences are not stylistic.

• In ordinary text between tags, only the ampersand and the less-than sign can change the meaning; the greater-than sign is escaped by convention, which is harmless and worth keeping.
• Inside a double-quoted attribute you need the ampersand and the double quote. Inside a single-quoted one you need the ampersand and the apostrophe instead.
• In an unquoted attribute the dangerous list grows to include spaces, tabs, backticks, equals signs and both angle brackets — the real argument for always quoting attributes.
• Inside a script or style element, references do nothing at all. Those elements have their own parsing rules, so an escaped quotation mark stays six literal characters and breaks your JavaScript.
• A URL in an href needs percent-encoding for its own characters, while entities handle the ampersands between query parameters — which is why a correct link often contains both.

One character, three ways to write it

An em dash can be written as —, — or — — a name, the decimal code point, and the same number in hexadecimal. All three give the identical character, and the numeric forms always work because they need no name to exist. É is É, É or É.

Above the basic plane there are no names, so an emoji must be numeric: 🎉 is 🎉 or 🎉. This tool writes one reference by working in code points. Tools stepping through UTF-16 code units emit the surrogate halves � and �, which no parser can reassemble — the usual reason an emoji renders as two question marks.

The semicolon is not optional. HTML forgives a missing one for a few legacy names, so &nbsp10 sometimes works, but XML and most template engines reject it, and the decoder flags it rather than repairing it.

Double-escaping, and how to recognise it

When a page displays &, or shows <b> as text instead of bold, something escaped text that was already escaped. It happens when a framework escapes output automatically and the value handed to it was escaped once already on its way into storage.

The fix is to escape exactly once, at the point of output, and to store the original characters. The mechanism is visible here: put & in and it returns &, because the ampersand starting that reference is itself a character needing an escape. Each decode peels off one layer.

When you genuinely need a reference

On a page served as UTF-8, accented letters, currency symbols and emoji can be typed directly. References earn their place for characters that are invisible or ambiguous in a source file: a non-breaking space, a zero-width joiner, a soft hyphen.

They matter in XML too, where only five names are predefined and the rest must be numeric. A footnote: ' is valid in HTML5 and XML but not in HTML 4, so ' is the safer apostrophe if anything ancient might read the document.

Decoding is done from a table rather than by letting the browser parse the input, so nothing in the text can execute and a malformed reference is reported instead of corrected. Nothing is uploaded — this is arithmetic on a string, done on your own machine.