How to Encode and Decode HTML Entities

HTML entities are stand-in codes that let you display characters a browser would otherwise treat as markup. The classic example is the less-than sign: type it directly and the browser starts looking for a tag, so you encode it as an entity to show it as plain text instead.

There are five reserved characters that most often need encoding: the ampersand, the less-than sign, the greater-than sign, the double quote, and the apostrophe. Anytime these appear in content that a browser will render as HTML, encoding them keeps your page displaying what you actually meant.

Entities come in two forms. Named entities use a readable label, while numeric entities use the character code point. Both render identically, but named entities are easier to recognize at a glance and numeric entities can represent any character even when no name exists.

For everyday reserved characters, named entities are the common choice because they are short and self-documenting. For unusual symbols, emoji, or characters from other writing systems, numeric entities are the reliable fallback since every character has a code point even if it has no friendly name.

Order matters when you encode. The ampersand is the character that begins every entity, so if you encode the other reserved characters before it, you will then re-encode the ampersands you just created and corrupt the output. This mistake is known as double-encoding.

The safe rule is to always encode the ampersand first, then handle the remaining reserved characters. Doing it in that sequence means every ampersand in the original text is converted exactly once and none of the freshly created entities get mangled. Decoding simply reverses the process, expanding both named and numeric entities back to the characters they represent.

The HTML Entity Converter handles both directions and takes care of the ordering for you. Here is the workflow for converting text either way.

Encode any user-supplied or dynamic text before you place it inside a page as HTML. This is the single most important habit for preventing broken layouts and cross-site scripting, since an unescaped angle bracket in user input can open a tag you never intended.

You generally do not need to encode text that is already inside a plain text field, a code block that the browser will not interpret, or content your framework escapes automatically. When in doubt, encode - a correctly encoded string always renders as the literal characters you wanted.