Skip to content

← All tools

Free online tool

HTML entity encoder and Unicode inspector

Turn text into HTML entities or back, see exactly which code points, bytes and characters a piece of text is made of, and get escape sequences for JavaScript, JSON, Python and CSS strings. Nothing is uploaded: it all runs in this page.

Turn text into HTML character references (&, é, 😀) or turn them back into text.

Direction
What to encode

The first choice is the one for putting text safely inside HTML. The other two are for systems that only accept plain ASCII.

Write them as

The apostrophe is always written ' in names mode, because ' is not part of HTML 4.

9 characters encoded: 8 as names, 1 as numbers.

How it works

  • •HTML entities: the first mode writes only & < > " and ' as references, which is what you need to put text inside an HTML page or a quoted attribute. The other two modes also write every non-ASCII character, or every character, for systems that only take plain ASCII. You can write them as names (&eacute;), decimal (&#233;) or hex (&#xE9;). Emoji are written as one reference, not two halves.
  • •Decoding runs once, so &amp;lt; becomes &lt; and not <. It understands decimal and hex references and the 253 named ones described next. Numeric references follow the HTML standard: &#0;, surrogates and anything above U+10FFFF become U+FFFD, and &#128; to &#159; are read as Windows-1252 characters (&#150; is an en dash). Names need the closing semicolon here. Anything it does not know is left exactly as written and listed.
  • •The name table has 253 entries: the 252 names of HTML 4.01 (accented letters, Greek letters, arrows, common symbols, &nbsp;, &copy;, &euro;) plus &apos;. Python's copy of the HTML5 table has 2,125 names, so there are many rare ones this page does not decode. The table was generated from that Python table by a script, not typed by hand.
  • •Unicode inspector: a code point is one number in the Unicode table. JavaScript counts UTF-16 units, where an emoji takes two. Files and the web mostly use UTF-8, where a code point takes one to four bytes. What a reader counts as one character (a grapheme cluster) can be several code points, and that count comes from your browser's text segmentation. Categories (letter, mark, symbol) come from your browser's Unicode data, so a very new character may show as unassigned in an older browser. Character names are not shown, because the name list would make this page much bigger.
  • •Normalization: the four forms NFC, NFD, NFKC and NFKD are produced by your browser. NFC and NFD only swap between equivalent spellings, such as e plus a combining accent and the single letter é. NFKC and NFKD also replace look-alikes, such as the fi ligature, which can change meaning.
  • •Escape formats: JavaScript \uXXXX (an emoji becomes a surrogate pair), JavaScript \u{X}, JSON, Python (\xXX, \uXXXX, \UXXXXXXXX) and CSS (\X, with a space after it only when the next character would otherwise be read as part of the number). Backslashes and control characters are always escaped, and you choose which quote mark the string uses. A lone surrogate or U+0000 cannot be written in CSS or as an HTML reference, so those become U+FFFD and you are told.
  • •How it was checked: the logic was compared with Python (html, unicodedata, json and ast), Perl (grapheme clusters) and Node's own parser on 156 strings, including emoji, combining marks, joiner sequences, lone surrogates and entity-like garbage, and the character categories of all 1,114,112 code points were compared with Python's. One code point differed (U+0295, which has a different category in the newest Unicode data than in Python's). A few strings were left out of some comparisons because Python or Perl have older Unicode data or older grapheme rules than your browser (Devanagari conjuncts, for example). Text longer than 200,000 characters is refused with a message instead of being processed.

Encoding is not sanitizing

Which characters are dangerous depends on where the text goes. In HTML text and quoted attributes, & < > and quotes matter, and the first mode covers them. Inside a <script> or <style> block, entities are not decoded at all, so you need JavaScript or CSS escaping there. In a link such as href, encoding does not stop a javascript: address; you must check the scheme. In an unquoted attribute, spaces and many other characters matter.

This page changes text; it does not remove tags, check URLs or understand where you will paste the result. It is not a sanitizer and does not make untrusted input safe. Use your template engine's built-in escaping for the right context, and never decode untrusted text with the Decode direction and then put it into a page as HTML.

Questions

Is my text uploaded?
No. Everything is calculated by code running in this page and nothing is sent anywhere. Copy happens on your device.
Why does one visible character count as several?
Text is stored as code points. The letter é can be one code point (U+00E9, 2 bytes in UTF-8) or an e followed by a combining accent (2 code points, 3 bytes). A family emoji of three people joined by invisible joiners is 5 code points, 8 UTF-16 units and 18 UTF-8 bytes, but a reader sees one character. The first sample in the inspector shows this. Normalizing to NFC joins the e and the accent into one letter.
Why was &bigstar; left as written?
Because it is not in this page's table of 253 names. Rather than guess, it keeps the text as it was and lists it. HTML5 has more than 2,000 names and this page knows only the common ones. A numeric reference such as &#9733; always works.
Does using the first mode make my page safe from cross-site scripting?
Only when the text goes into HTML text or a quoted attribute. It does nothing for script blocks, style blocks, URLs or unquoted attributes, and it is no substitute for your framework's escaping. See the section above.

Related