HTML encoder and decoder for text and entities

HTML5 character references

Quotes can remain literal in ordinary HTML text; escape the matching quote when inserting text into a quoted attribute.

The WHATWG named character reference list  defines the names supported by modern HTML.

HTML4 character references

The W3C HTML 4.01 entity reference  documents the older named set. HTML4 does not define '; use ' for an apostrophe when that compatibility matters. These shared names also work in HTML5.

XML character references

XML defines only five predefined entity names . They work without a DTD or custom entity declaration. References are case-sensitive and require a semicolon.

Names such as   and © are not predefined in XML. Use   for a non-breaking space or © for ©, or declare the names in a DTD. Numeric references must still identify characters allowed by XML.

Choose Text with quotes to escape these five characters. This tool does not validate XML or remove forbidden characters, and Decode mode uses HTML5 rules rather than parsing XML.

JavaScript and TypeScript

The entities library  works in Node.js and browser bundles. Install it with npm install entities. This example uses escapeText, the same function as this tool’s default HTML text (recommended) option. Use escapeUTF8 for Text with quotes, or encodeNonAsciiHTML for Extended entities.

import { escapeText, decodeHTML } from "entities";

const text = "<p>Tea & coffee</p>";
const encoded = escapeText(text);
const decoded = decodeHTML(encoded);

console.log(encoded); // &lt;p&gt;Tea &amp; coffee&lt;/p&gt;
console.log(decoded); // <p>Tea & coffee</p>

When putting plain text on a web page, assigning it to textContent  avoids interpreting it as markup. encodeURIComponent performs URL encoding, which is a different operation.

Python

Python’s built-in html module  includes both operations. html.escape escapes quotes by default while leaving ordinary Unicode text unchanged; html.unescape recognizes HTML5 named and numeric references.

import html

text = "<p>Tea & coffee</p>"
encoded = html.escape(text, quote=True)
decoded = html.unescape(encoded)

print(encoded)  # &lt;p&gt;Tea &amp; coffee&lt;/p&gt;
print(decoded)  # <p>Tea & coffee</p>

PHP

Use htmlspecialchars  for special characters and html_entity_decode  to decode references. Explicit flags select HTML5, escape both quote types, and replace invalid UTF-8 sequences during encoding. Ordinary Unicode letters remain unchanged.

<?php
$text = '<p>Tea & coffee</p>';
$flags = ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML5;
$encoded = htmlspecialchars($text, $flags, 'UTF-8');
$decoded = html_entity_decode($encoded, $flags, 'UTF-8');

// Run in the CLI to inspect both strings as text.
echo $encoded, PHP_EOL; // &lt;p&gt;Tea &amp; coffee&lt;/p&gt;
echo $decoded, PHP_EOL; // <p>Tea & coffee</p>

C# and .NET

System.Net.WebUtility  provides HTML conversion without an additional package. HtmlEncode and HtmlDecode are convenient for strings; do not assume every HTML5 named reference is recognized by every platform’s decoder.

using System;
using System.Net;

string text = "<p>Tea & coffee</p>";
string encoded = WebUtility.HtmlEncode(text);
string decoded = WebUtility.HtmlDecode(encoded);

Console.WriteLine(encoded); // &lt;p&gt;Tea &amp; coffee&lt;/p&gt;
Console.WriteLine(decoded); // <p>Tea & coffee</p>

Go

Go’s standard html package  escapes the five special characters and decodes a broader set of references. For an actual HTML template, prefer html/template , which applies escaping according to the surrounding context.

package main

import (
    "fmt"
    "html"
)

func main() {
    text := "<p>Tea & coffee</p>"
    encoded := html.EscapeString(text)
    decoded := html.UnescapeString(encoded)

    fmt.Println(encoded) // &lt;p&gt;Tea &amp; coffee&lt;/p&gt;
    fmt.Println(decoded) // <p>Tea & coffee</p>
}

Rust

Add the html-escape crate  with cargo add html-escape. Its encode_text function escapes &, <, and > for ordinary HTML text. It leaves quotes alone; use the crate’s appropriate attribute encoder for a quoted attribute value. decode_html_entities decodes terminated named and numeric references, with stricter behavior than a browser for malformed input.

use html_escape::{decode_html_entities, encode_text};

fn main() {
    let text = "<p>Tea & coffee</p>";
    let encoded = encode_text(text);
    let decoded = decode_html_entities(encoded.as_ref());

    println!("{}", encoded); // &lt;p&gt;Tea &amp; coffee&lt;/p&gt;
    println!("{}", decoded); // <p>Tea & coffee</p>
}

Java

Add Apache Commons Text (org.apache.commons:commons-text) to your Maven or Gradle project. Its StringEscapeUtils  provides escapeHtml4 and unescapeHtml4. These use HTML4 names, not the full HTML5 set; apostrophes are not escaped by escapeHtml4.

import org.apache.commons.text.StringEscapeUtils;

public class HtmlEntitiesExample {
    public static void main(String[] args) {
        String text = "<p>Tea & coffee</p>";
        String encoded = StringEscapeUtils.escapeHtml4(text);
        String decoded = StringEscapeUtils.unescapeHtml4(encoded);

        System.out.println(encoded); // &lt;p&gt;Tea &amp; coffee&lt;/p&gt;
        System.out.println(decoded); // <p>Tea & coffee</p>
    }
}

Swift

Add SwiftSoup through Swift Package Manager  and include its product in your target. Use Entities.escape  for HTML text and Parser.unescapeEntities  to decode references without stripping tags or rendering HTML. The false argument selects text rather than attribute context for decoding. Text escaping leaves quotes unchanged, so it is not a quoted-attribute encoder.

import SwiftSoup

let text = "<p>Tea & coffee</p>"
let encoded = Entities.escape(text)

do {
    let decoded = try Parser.unescapeEntities(encoded, false)
    print(encoded) // &lt;p&gt;Tea &amp; coffee&lt;/p&gt;
    print(decoded) // <p>Tea & coffee</p>
} catch {
    print("Could not decode HTML entities: \(error)")
}

Delphi / Object Pascal

Delphi’s TNetEncoding.HTML , from System.NetEncoding, provides Encode and Decode. It escapes &, <, >, and double quotes. Its documented decoder recognizes numeric references and the names amp, lt, gt, and quot; do not expect full HTML5 named-entity support or apostrophe escaping. This example uses Delphi’s runtime library, which is not shared by every Object Pascal compiler.

program HtmlEntitiesExample;

{$APPTYPE CONSOLE}

uses
  System.NetEncoding;

var
  Text, Encoded, Decoded: string;
begin
  Text := '<p>Tea & coffee</p>';
  Encoded := TNetEncoding.HTML.Encode(Text);
  Decoded := TNetEncoding.HTML.Decode(Encoded);

  Writeln(Encoded); // &lt;p&gt;Tea &amp; coffee&lt;/p&gt;
  Writeln(Decoded); // <p>Tea & coffee</p>
end.