HTML Entity Encoder / Decoder
Escape text into HTML entities or decode entities back to characters, live. Named or numeric output, the real WHATWG entity set, nothing uploaded.
This text is over 2,000 characters, too long to carry in a link, so the address bar keeps only the settings and Copy link is off. Shorten it to share it as a link.
Runs entirely in your browser — your text never leaves your device. Encoding and decoding use a small script and a committed copy of the WHATWG named-entity table you can read; there are no network requests for the conversion. A shared link carries its text in the URL itself (up to 2,000 characters), so whoever opens it sees that text — and so does any browser history or chat it is pasted into.
Offline later: once you have opened this page with a connection, it reopens and works with none — your browser keeps a copy. Not saved: the very first Polyatic page you ever open (open it again while online), and any page or link you have never opened.
What this tool does
Paste text on the left and its encoded or decoded form appears on the right the instant you type — there is no button to hunt for. Encode turns characters into HTML entities so they can sit safely inside a web page; Decode reverses that, turning entities back into the characters they stand for. Every character reference this tool recognises comes from the published WHATWG Named character references table, the same list browsers use, so nothing is guessed.
Open it pre-filled from a link
The page reads its input from the address, so a link can hand over a finished encoding. ?text= is the percent-encoded input, mode=decode switches direction (encode is the default), and style= picks the encode mode: named (all non-ASCII, named where a name exists, else decimal), named-hex (the same with hex fallback), decimal or hex (all non-ASCII as numeric references); without it only the five markup characters are escaped. For example /html-entities/?text=%3Ca%3E%20%C3%A9&style=named opens showing <a> é, and ?mode=decode&text=%26lt%3Bb%26gt%3B shows <b>. A value the page does not recognise is ignored and that control keeps its default. As you edit, the address bar follows along (without adding Back-button entries) for texts up to 2,000 characters; longer text stays out of the URL, since many browsers, chat apps and servers truncate links of that size.
The three encode modes, and when to use each
Markup characters only (named) is the default and the one you want most of the time. It escapes just the five characters that mean something to the HTML parser — & < > " ' — and leaves every other character, including accented letters and emoji, exactly as-is. This is the correct, minimal transform for dropping arbitrary text into HTML body content or an attribute value. For example:
All non-ASCII — numeric also escapes every character above code point 127 as a numeric reference, in &#NNN; decimal or &#xHH; hex. Reach for this when the file, database column or email system that will carry your HTML is not reliably UTF-8 and you need pure ASCII on the wire. All non-ASCII — named where one exists does the same but prefers a readable name — ©, —, £ — falling back to a numeric reference for the many characters that have no name.
Named vs numeric, side by side
All of these are three spellings of the very same character; a browser renders them identically:
| Char | Name | Named | Decimal | Hex |
|---|---|---|---|---|
| & | ampersand | & | & | & |
| < | less-than | < | < | < |
| © | copyright | © | © | © |
| — | em dash | — | — | — |
| ·nbsp· | no-break space | |   |   |
| 😀 | (no name) | — | 😀 | 😀 |
Note the last row: emoji and most symbols have no named reference, so a named-mode encoder falls back to a numeric one for them. That is expected, not a bug — only about 2,125 characters have WHATWG names.
Decoding, and how invalid input is handled
Decode resolves all three forms at once — named (—), decimal (—) and hex (—) — and it is deliberately conservative:
- Unknown named references are left untouched.
©becomes©, but&nope;stays&nope;— the tool never invents a character for a name it does not recognise. - A bare ampersand is preserved.
Tom & JerryandAT&Tcome through unchanged, because neither&begins a complete&…;reference. - Out-of-range numeric references are preserved. A code point above U+10FFFF, such as
�, is left as written rather than mangled. - Astral characters survive.
😀decodes to😀, and even a split pair like��reassembles correctly.
Honest limits
On decode, this tool requires the trailing semicolon: © resolves but the legacy no-semicolon form © is left as text. Real browsers accept a short list of those semicolon-less references in specific positions, but the rules are context-sensitive and easy to get subtly wrong, so this tool sticks to the unambiguous, always-valid form. It also escapes by rule, not by context — it will not, for instance, know that text destined for a <script> block or a URL needs a different escaping scheme. For URLs use the URL encoder; for JSON string escaping use the JSON formatter.
Common uses
Pasting a snippet of code or markup into a blog post or documentation (escape it so the tags show as text rather than render); preparing user-supplied text for safe insertion into a template; forcing tricky typography — em dashes, curly quotes, non-breaking spaces — into ASCII-only entities for a fussy CMS or email; and cleaning up a fragment someone sent you full of & and ' by decoding it back to readable text.