HTML Encode: Text to HTML Entities

HTML encoding escapes the characters that break markup. For a value going into a URL use the URL percent-encoder.

Turn HTML entities back into characters →

How do you encode text as HTML entities?

HTML encoding replaces the characters a browser would otherwise read as markup, so they reach the page as text instead of as tags.

1. Find every character that markup would read as syntax rather than as text.
2. Replace it with its named reference where the HTML standard gives it one: &, <, >, ", '.
3. Write anything else you need to escape as a numeric reference, &#nnn; in decimal or &#xhh; in hexadecimal.
4. Leave the rest of the text alone. A UTF-8 document needs no reference for é or €.
5. Paste the result into your markup. A & B < C becomes A &amp; B &lt; C.

Text to HTML Entities Conversion Table

Five names are predefined and carried by both XML and HTML: &amp; for the ampersand, &lt; for the less-than sign, &gt; for the greater-than sign, &quot; for the double quote and &apos; for the apostrophe. An HTML character reference starts with an ampersand and ends with a semicolon. A named reference uses a name from the HTML standard's table (&amp;); a numeric one uses &# and decimal digits (&#65;) or &#x and hexadecimal digits (&#x41;). The last row is &nbsp; = a no-break space (code point U+00A0), which is not one of the five but is the reference you are most likely to meet.

The same value in each encoding

These rows are shared with the other encoders, so a value written here is the value every page in the family writes.

Every value below is the one the specification fixes, so a result that disagrees with a row here is a result to check. ASCII defines 128 characters, codes 0–127, using 7 bits; in practice each code is stored in one 8-bit byte with a leading 0.

Worked Example: "A & B < C" to HTML Entities

One character at a time, with the working written out. This is the same grid the converter shows when you turn on "show steps".

In HTML text only two things must be escaped: a less-than sign, and an ampersand that would otherwise start a character reference. Inside a quoted attribute value the quote character that closes it must be escaped as well.

Read the grid a row at a time: & at U+0026 becomes &amp;; < at U+003C becomes &lt;. Every other character is left exactly as it was, which is what keeps the result readable — an escaped document is still the same text, with four or five characters standing in for one.

A is ASCII 65 = 0x41 = 0o101 = 0b01000001; a is 97 = 0x61 = 0o141 = 0b01100001. Uppercase and lowercase differ by 32, which is bit 5. The number in a numeric reference is that code point, so the decimal and the hexadecimal forms of one character are two spellings of one value rather than two different references. Counting the characters is the quickest check on the result: a reference stands for exactly one of them, however many characters it takes to write, so the text either side of it is untouched and the length of the escaped string tells you nothing about the length of the text it holds.

Check it in reverse

In HTML text only two things must be escaped: a less-than sign, and an ampersand that would otherwise start a character reference. Inside a quoted attribute value the quote character that closes it must be escaped as well. Reading it back is the same rule in reverse: an ampersand opens a reference, a semicolon closes it, and what sits between them names one character. To verify the result by hand, decode the entity output back to characters and compare it with what you started from.

Worked examples: text to HTML entities

Each example gives the value first, then the working. Click a value to load it in the converter.

Every example above reverses exactly - read the same entities back as the characters they stand for.

What Has to Be Escaped, and Where?

Named reference or numeric reference?

A numeric character reference can write any code point. A named one works only for a name that appears in the HTML standard's table; an ampersand followed by a name that is not in the table stays as literal text.

Does a reference need its semicolon?

For legacy compatibility some named references appear in the HTML standard's table both with and without the closing semicolon, so a decoder may resolve a name that has no semicolon after it. This converter writes the semicolon every time, because a reference without one is only readable by luck.

What case are the hexadecimal digits?

0b marks binary, 0o octal, 0x hexadecimal; a leading # marks a hex colour. Hexadecimal is not case-sensitive (FF = ff); iToolHub writes hex digits in uppercase. A numeric reference is read the same either way.

Is this the encoding you need at all?

The three schemes protect different things and are not interchangeable. these encodings are not interchangeable - what entities protect that percent-encoding does not sets out which does what.

Text to HTML Entities in Code

Both standard libraries carry this conversion, so the one-liner below is the whole job. Check the result against the table above before you trust it in a pipeline.

Python: html.escape('A & B', quote=True)

JavaScript: s.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;')

Common Mistakes

• Escaping a value that is already escaped, which turns an ampersand into &amp;amp; and shows the reference itself on the page.
• Trusting a decoder to fix broken markup. It reads references; it does not repair tags.
• Writing a reference with no semicolon and expecting every reader to guess where it ends.
• escaping a URL with entities - percent-encoding for URLs is the scheme a URL expects.

Frequently Asked Questions

Related Conversions

• a URL needs a different scheme - escape reserved characters for a URL instead.
• for a picture rather than a string, encode a file rather than a string.
• to carry bytes through a text-only channel, turn text into a Base64 string.
• when the value is a data URI, save a Base64 image as a file.
• if the value is already Base64, turn a Base64 string into the bytes it holds first.
• if the value arrived percent-encoded, decode the triplets in a URL first.

The rest of the family sits on every encoder and decoder in this family.