HTML Entities Encoder/Decoder: Special Characters, and Symbols
Choose Encode to turn text into HTML-safe text: `&`, `<`, `>`, double and single quotes become entities, so the text can be placed inside HTML without being interpreted as markup. Tick the option to also write every non-ASCII character, such as é, €, arrows or emoji, as a numeric reference. Choose Decode to turn entities back into characters; the decoder understands all 2,231 named references in the HTML standard, from ` ` to `→`, plus decimal and hexadecimal references such as `™` and `™`.
What HTML entities are
An HTML character reference, usually called an entity, writes a character indirectly. There are three forms: named (©), decimal (©) and hexadecimal (©). All three produce ©. Named references exist for about two thousand characters; numeric references work for any Unicode code point.
Entities are needed for two reasons. The first is syntax: < starts a tag and & starts an entity, so to show those characters as text they must be escaped. The second is historical: before UTF-8 became universal, entities were the only reliable way to put characters outside the page's encoding into a document. Today, with <meta charset="utf-8">, you can type é, — or → directly, and entities are mostly used for the syntax characters and for invisible ones such as the non-breaking space.
The five characters to escape
& & always, because it starts every entity
< < in text, so it is not read as a tag
> > for symmetry and in some attribute contexts
" " inside attribute values in double quotes
' ' inside attribute values in single quotesThe encoder escapes all five, which makes the output safe both in element content and in quoted attribute values. It uses ' for the apostrophe rather than ', because ' was not defined in HTML 4 and some older parsers and email clients do not recognise it.
Escape & first. Escaping < to < and then escaping & would turn it into &lt;, which displays as the literal text <. Double-escaped output like this is common when a template engine escapes a value that was already escaped; decode it once to see the original.
Symbols and arrows: entity and Unicode codes
non-breaking space U+00A0  
© © U+00A9 ©
® ® U+00AE ®
™ ™ U+2122 ™
— — em dash U+2014 —
… … ellipsis U+2026 …
€ € U+20AC €
→ → right arrow U+2192 →
↑ ↑ up arrow U+2191 ↑
✓ ✓ check mark U+2713 ✓
☆ ☆ star U+2606 ☆To find the code for any symbol, paste the character into the encoder with the non-ASCII option ticked; the output is its decimal reference. The number is the Unicode code point, so → and → are the same arrow, and in CSS the same character is written \2192 inside a content value.
Arrows are what people look up most. Single arrows have lower-case names, ← ←, ↑ ↑, → → and ↓ ↓, and the double arrows capitalise the first letter: ⇐ ⇐, ⇑ ⇑, ⇒ ⇒. ↠ is the two-headed arrow ↠. Decorative arrows such as ➜ have no name, so they need the numeric form, ➜. Superscripts work the same way: ² and ³ give ² and ³, but for anything longer, such as footnote numbers or exponents, the <sup> element is the right tool.
Non-breaking spaces
is the most used entity. It looks like a space but prevents a line break, which keeps together numbers and units (10 km), initials, and short words that should not end a line. Browsers also do not collapse consecutive non-breaking spaces, which is why old HTML used rows of for indentation; use CSS margins or padding for that instead.
Non-breaking spaces cause subtle bugs when text is copied into code or data. A string that contains U+00A0 looks identical to one with a normal space but does not match it in comparisons, trim() in some languages, or a regex looking for \x20. Decoding the text here and comparing it in a diff checker exposes them.
Escaping and XSS
Cross-site scripting happens when user input is inserted into a page as HTML. Escaping the five characters above is the correct defence when the value goes into element content or a quoted attribute. Modern template engines, such as Blade's {{ }}, Twig, Django templates and React's JSX, do this automatically, and so does Jinja2 when autoescaping is enabled, as Flask does for HTML templates; the risk comes from bypasses such as {!! !!}, |safe, v-html or dangerouslySetInnerHTML.
HTML escaping is not enough in other contexts. Inside a <script> block, a URL in href or src, a CSS value, or an unquoted attribute, different rules apply: a javascript: URL contains no characters that HTML escaping changes. Validate URLs against an allow list of schemes, pass data to scripts as JSON in a data attribute, and follow the OWASP XSS Prevention Cheat Sheet for each context.
htmlspecialchars($text, ENT_QUOTES | ENT_HTML5, 'UTF-8'); // PHP
html.escape(text) # Python, quotes included
element.textContent = text; // JavaScript: set text, not innerHTMLUsing the HTML decoder safely
The decoder uses the browser's own HTML parser on a text-only element, so every named and numeric reference is decoded exactly as a browser would decode it, including legacy forms without a semicolon such as ©, and no markup in the input is executed. Use it to read escaped text from JSON APIs, RSS feeds, email templates or database fields that were stored escaped.
Decoding is local: the browser's own parser does the work in this tab, so a support ticket or a database export pasted here just to read its escaped text goes nowhere.
Frequently asked questions
What is the HTML entity for a non-breaking space?
, or numerically  . It displays as a space but prevents a line break at that point and is not collapsed with neighbouring spaces.
Which characters must be escaped in HTML?
& and < in text, and the quote character used around an attribute value. Escaping all five of &, <, >, " and ' makes text safe for both element content and quoted attributes.
How do I write an arrow or other symbol in HTML?
Use a named entity such as → for →, or the numeric code point such as →. With UTF-8 pages you can also type the character directly.
What is the difference between ' and '?
Both produce an apostrophe. ' is defined in HTML5 and XML but not in HTML 4, so ' is the more compatible choice, especially for email.
Why do I see &lt; on my page?
The text was escaped twice: < became < and then & became &. Escape values only once, usually by letting the template engine do it.
Does HTML encoding prevent XSS?
It prevents XSS for values placed in HTML text and quoted attributes. Values in scripts, URLs, CSS or unquoted attributes need context-specific handling as well.