HTML Entity Converter

Common questions

What does < mean, and how do I decode it?

< is how a page writes a less-than sign when it needs the character rather than the start of a tag. Paste it into the entities box and the text box shows the character itself. The same rule covers the rest of the set: > is a greater-than sign, & an ampersand, " a double quote,   a space that does not break a line, and é an e with an acute accent. A number works as well as a name: < and < are both the less-than sign, written in decimal and in hexadecimal, and 😀 is a grinning face. This tool decodes a reference when it ends in a semicolon, so < decodes and &lt on its own is left as text with a line saying why.

Why does the result still show < after decoding?

Because the text was escaped twice, and this tool takes exactly one layer off. < is the way a page writes the four characters <, so decoding it once gives you those four characters back, not a tag. That is the correct answer, and it is usually the thing you were trying to find out: text that arrives double-escaped came through one encoder too many, and seeing one layer disappear tells you how many are left. Paste the result back in and the next layer comes off. A decoder that keeps going until nothing changes will happily turn text somebody deliberately escaped into live markup, which is why this one stops after a single pass.

Which entities does it know?

The 253 named references of the HTML 4 set, which is the group every browser has agreed on for decades: the markup five, the Latin-1 accents and symbols, the Greek letters, the arrows, the mathematical operators and the punctuation such as … and ’. Numeric references are not limited to a table at all, so any code point up to U+10FFFF decodes, in decimal or in hexadecimal, with leading zeros allowed. Names are case sensitive, so é and É are two different letters, and a name the table does not carry, such as ⌣, is left exactly as it was written and listed underneath with its position instead of being quietly dropped.

Is it safe to decode HTML that contains a script tag?

Yes, and that is the reason this tool is built the way it is. The decoder is a plain string scanner: it has no parser, no page fragment and no element to set markup on, so there is nothing in the path that could run what the text spells. Decoding <script>alert(1)</script> gives you those characters as text in a text box, and the box shows them the way it would show any other line you typed. The same holds for the worked examples and for the explanation list under the result: everything on this page is text, printed as text.

What do the three encoding policies change?

They choose which characters are covered, and nothing else moves. Named covers the five markup characters and everything outside plain ASCII, writing the HTML name where there is one and a number where there is not, so an accented e becomes é and an emoji becomes 😀. Numeric covers the same characters and writes all of them as decimal numbers, which needs no name table at the far end. Markup only covers the ampersand, the two angle brackets and the two quote characters, leaving accents, emoji and everything else exactly as they were, which is what you want when the page is already UTF-8. Under every policy an apostrophe is written ' rather than ', because ' is an HTML 5 name that an HTML 4 parser prints as text instead of an apostrophe, and a tab, a line feed and a carriage return are left alone so a paste keeps its lines.

What happens to a number no character answers to, such as � or �?

It becomes the replacement character U+FFFD and the tool says why, with the position it was found at. Three cases get that treatment: zero, a surrogate half such as �, which is part of a character rather than a character, and any number above U+10FFFF, the highest code point Unicode defines. Numbers in the 128 to 159 range are a different case and are remapped, not replaced: € is a Windows-1252 number written as though it were Unicode, and browsers read it as the euro sign, so that is what comes out here, with a line saying so. A decoded control character that does not print is reported too, because a result that looks unchanged should never be hiding something invisible.

Is my text sent anywhere, and is there a size limit?

The conversion happens in your browser, so there is no server in this, no account and nothing logged. The tool remembers two things in this browser, the direction and the encoding policy, so it opens the way you left it, and the text in the boxes is never written to storage or sent anywhere. The Start over button above the tool forgets those two settings. There is no length limit: a line is as welcome as a log file with a hundred thousand references in it, and the only ceiling is your own device. When a paste produces thousands of explanations the count stays exact and the list shows the first fifty, so a large file never fills the page with the same sentence.