HTML Entity Converter
Escape and unescape special characters
Input
Options
Result
Nothing entered yet
Paste your text and the converted result appears here.
Common entities
- &
& - <
< - >
> - "
" - '
' - (space)
- ©
© - ®
® - ™
™ - €
€ - ·
· - …
… - —
— - →
→ - ★
★
On a UTF-8 page, escaping &, < and > is enough.
Angle brackets and ampersands are structure in HTML, not text. Putting them into a page unescaped either breaks the layout or opens an injection hole. Converting them to entities makes them display as the characters they are.
How to use
- 1 Choose encode or decode.
- 2 Paste your text or HTML.
- 3 Turn on the full option if the target page has no charset declaration.
- 4 Copy the result.
Frequently asked questions
Which characters actually need escaping?
In text content, & and <. In attribute values, also " and '. The > is escaped by convention rather than necessity. Escaping those covers the injection risk.
Should I escape accented and non-Latin characters?
Not on a modern UTF-8 page — they work as-is and stay readable in the source. Escape everything only when the output goes somewhere with an unknown or legacy encoding.
Does escaping prevent XSS?
It is the core of the defence, but context matters. Text inside a page needs HTML escaping; a value inside a script tag or a URL attribute needs different escaping. Escaping for the wrong context still leaves a hole.