Loading HTML Entity Converter…
Nothing to convert yet.
&& &Starts every reference, so an unescaped one can swallow the text after it.<< <Starts a tag. This is the one that turns text into markup.>> >Ends a tag. Safe in text in practice, escaped by convention and by every serialiser."" "Ends a double-quoted attribute value early.'' 'Ends a single-quoted attribute value early. ' is HTML5 and XML; older HTML4 parsers want '.Which of the five you need depends on where the text lands. In a text node, & and < are the only ones that can change the meaning. Inside a double-quoted attribute you also need "; inside a single-quoted one you need the apostrophe instead. Leave an attribute unquoted and the list grows to include spaces, backticks and equals signs, which is why unquoted attributes are a bad habit rather than a shortcut.
Escaping is not a substitute for context. Entities do nothing at all inside a <script> or <style> block — those elements have their own parsing rules, so an escaped quotation mark there stays the literal six characters. A URL in an href needs per-cent encoding, not entities. Use your template language’s own escaping for anything user-submitted; this tool is for hand-editing markup, not for sanitising input.
Decoding is done from a table of 150 named references rather than by handing the text to the browser to parse, so nothing here can execute and a broken reference is reported instead of being quietly repaired. The full HTML5 list runs past 2,200 names; the ones missing from this table are the rare mathematical variants, and numeric references cover every character regardless.
HTML lets every character be written as a reference, and almost none of them need it. The exceptions are the ones a parser acts on: an ampersand, a less-than sign, a greater-than sign and the two quotation marks. Escape those and text stays text. The dashes, arrows, accented letters and card suits are a typing convenience, not a safety measure.
This converter goes both ways: the five alone, a name for every character that has one, or decimal or hexadecimal references throughout — and it reads all three forms back to plain text.
The right answer depends on where the text lands, and the differences are not stylistic.
An em dash can be written as —, — or — — a name, the decimal code point, and the same number in hexadecimal. All three give the identical character, and the numeric forms always work because they need no name to exist. É is É, É or É.
Above the basic plane there are no names, so an emoji must be numeric: 🎉 is 🎉 or 🎉. This tool writes one reference by working in code points. Tools stepping through UTF-16 code units emit the surrogate halves � and �, which no parser can reassemble — the usual reason an emoji renders as two question marks.
The semicolon is not optional. HTML forgives a missing one for a few legacy names, so  10 sometimes works, but XML and most template engines reject it, and the decoder flags it rather than repairing it.
When a page displays &amp;, or shows <b> as text instead of bold, something escaped text that was already escaped. It happens when a framework escapes output automatically and the value handed to it was escaped once already on its way into storage.
The fix is to escape exactly once, at the point of output, and to store the original characters. The mechanism is visible here: put & in and it returns &amp;, because the ampersand starting that reference is itself a character needing an escape. Each decode peels off one layer.
On a page served as UTF-8, accented letters, currency symbols and emoji can be typed directly. References earn their place for characters that are invisible or ambiguous in a source file: a non-breaking space, a zero-width joiner, a soft hyphen.
They matter in XML too, where only five names are predefined and the rest must be numeric. A footnote: ' is valid in HTML5 and XML but not in HTML 4, so ' is the safer apostrophe if anything ancient might read the document.
Decoding is done from a table rather than by letting the browser parse the input, so nothing in the text can execute and a malformed reference is reported instead of corrected. Nothing is uploaded — this is arithmetic on a string, done on your own machine.
No, provided the page declares UTF-8 and the file is saved that way. Writing é instead of é makes the source harder to read and to search, for nothing. The exception is a system that mangles non-ASCII in its pipeline.
Because it refuses to break. A line will not wrap at a non-breaking space and consecutive ones do not collapse, which makes it useful between a number and its unit, and a poor way to indent or space out a layout.
Only in the context it was chosen for. HTML escaping does nothing inside a script block, inside a URL, or in an unquoted attribute, so a value placed there stays exploitable. Let your template engine escape for the context rather than assembling markup from strings.
A name where a well-known one exists, because — is readable and — is not. Hexadecimal suits anything you look up in a Unicode chart, since charts list code points that way.