{"id":105,"date":"2026-05-04T19:20:35","date_gmt":"2026-05-04T23:20:35","guid":{"rendered":"https:\/\/simpletool.io\/blog\/?p=105"},"modified":"2026-05-04T19:20:35","modified_gmt":"2026-05-04T23:20:35","slug":"html-entity-decoder","status":"publish","type":"post","link":"https:\/\/simpletool.io\/blog\/html-entity-decoder\/","title":{"rendered":"HTML Entity Decoder & Encoder: Escape HTML Safely [2026]"},"content":{"rendered":"
TL;DR:<\/strong> An HTML entity decoder turns escape sequences like &lt;<\/code>, &amp;<\/code>, &#039;<\/code>, and &quot;<\/code> back into the original characters (<<\/code>, &<\/code>, '<\/code>, \"<\/code>). The encoder does the reverse \u2014 replacing unsafe HTML characters with named or numeric entities so the browser renders them as text instead of parsing them as markup. Use our free HTML encoder\/decoder<\/a> to escape user input safely or recover content from a feed that arrived double-encoded.<\/div>\n

Every web developer eventually pastes a string from a CMS export, an XML feed, or a database column and sees &amp;quot;Hello&amp;quot;<\/code> where they expected \"Hello\"<\/code>. That’s an HTML entity round-trip gone wrong. HTML escapes a small set of characters that have structural meaning \u2014 <<\/code>, ><\/code>, &<\/code>, \"<\/code>, '<\/code> \u2014 into named entities (&lt;<\/code>, &gt;<\/code>, &amp;<\/code>, &quot;<\/code>, &#039;<\/code>) so they appear as text rather than triggering tag parsing. Get the encoding right and your user-supplied content is rendered safely; get it wrong and you have either visible escape sequences or, worse, an XSS vulnerability.<\/p>\n

Our HTML encoder and decoder<\/a> handles named entities (&eacute;<\/code>, &copy;<\/code>, &ndash;<\/code>), numeric decimal entities (&#233;<\/code>, &#169;<\/code>), numeric hex entities (&#x00E9;<\/code>), and the full HTML5 named-entity table (2,231 named entities). It runs entirely in your browser. This guide covers when to encode, the difference between named and numeric entities, double-encoding, and the XSS edge cases naive encoders miss.<\/p>\n

The 5 characters you must always escape \u2014 and 2 you should<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n
Character<\/th>\nNamed entity<\/th>\nNumeric (decimal)<\/th>\nRequired in<\/th>\n<\/tr>\n<\/thead>\n
&<\/code><\/td>\n&amp;<\/code><\/td>\n&#38;<\/code><\/td>\nEverywhere \u2014 encode first or you’ll double-encode<\/td>\n<\/tr>\n
<<\/code><\/td>\n&lt;<\/code><\/td>\n&#60;<\/code><\/td>\nText content \u2014 prevents tag injection<\/td>\n<\/tr>\n
><\/code><\/td>\n&gt;<\/code><\/td>\n&#62;<\/code><\/td>\nText content (defensive \u2014 not strictly required)<\/td>\n<\/tr>\n
\"<\/code><\/td>\n&quot;<\/code><\/td>\n&#34;<\/code><\/td>\nInside double-quoted attributes<\/td>\n<\/tr>\n
'<\/code><\/td>\n&#39;<\/code><\/td>\n&#39;<\/code><\/td>\nInside single-quoted attributes (note: &apos;<\/code> is HTML5 only)<\/td>\n<\/tr>\n
\u00a9<\/code><\/td>\n&copy;<\/code><\/td>\n&#169;<\/code><\/td>\nOptional \u2014 only if not serving as UTF-8<\/td>\n<\/tr>\n
\u2014<\/code> (em dash)<\/td>\n&mdash;<\/code><\/td>\n&#8212;<\/code><\/td>\nOptional \u2014 only if not serving as UTF-8<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Named vs numeric vs hex entities<\/h2>\n

You’ll see HTML entities in three forms in the wild. Named<\/strong> entities like &copy;<\/code> are readable but only work for the ~2,231 characters that have an HTML5 name. Numeric decimal<\/strong> entities like &#169;<\/code> reference the Unicode code point in base 10. Hex<\/strong> entities like &#xA9;<\/code> reference the same code point in base 16. All three render identically.<\/p>\n