Guides
HTML entities cheat sheet for editors
Editors who paste into CMS fields, email HTML, and static snippets meet &, <, and long before they meet a full engineering escaping guide. This cheat sheet stays on the characters you actually touch and the encode/decode workflow that fixes broken previews. Use HTML entities in the browser when a feed shows soup or when a title with & wrecks a template. For query strings, switch to URL encode instead.
Why editors need entities at all
HTML treats <, >, and & as markup controls. If a product name is AT&T plans <promo>, a raw paste can open a phantom tag or truncate the sentence. Entities tell the browser to show the symbol instead of acting on it.
Email HTML and older CMS modes are stricter than a modern React app. A character that survives in a preview pane can still break a newsletter builder. Encoding the risky characters is the boring fix that prevents a reopen of the ticket.
Feeds and scraped notes often arrive already encoded. Double encoding turns & into &amp; and makes titles unreadable. Decode once, edit, encode once on the way back out.
Common entities editors actually use
Memorize a short list. Look up the rest when needed.
| Character | Entity | When you see it |
|---|---|---|
& |
& |
Company names, copy about fees |
< |
< |
Comparisons, code mentions |
> |
> |
Comparisons, arrows in text |
" |
" |
Quoted attributes and some CMS modes |
' |
' or ' |
Titles and attributes |
| non-breaking space | |
Forced gaps in legacy layouts |
— em dash |
— |
Imported Word copy (prefer real editing policy) |
€ / £ |
€ / £ |
Price lines in constrained editors |
You do not need the full Unicode entity encyclopedia for daily editing. You need muscle memory for &, <, and >, plus a decoder for everything else.
Ampersand first
& starts every entity. A bare & in HTML is the most common editor foot-gun. Encode it even when the rest of the sentence looks plain. Company legal names with ampersands fail previews more often than exotic symbols do.
Non-breaking spaces and invisible cousins
holds a line together in old templates. It also creates “spaces” that break CSV and search. If a paste behaves oddly in a sheet, inspect it with Hidden Characters and read Invisible characters breaking your CSV.
When to encode versus decode
Encode when you move plain text into an HTML context: CMS WYSIWYG source mode, email snippets, static HTML includes. Decode when you read logs, RSS titles, or exported HTML and need editable words again.
CMS and email
Paste plain copy into HTML entities, encode, then paste into the HTML field. Spot-check the preview. If the CMS already escapes on save, ask an engineer before you double encode. Newsletter tools vary; one encode pass is the usual safe default for raw HTML modules.
Feeds and logs
Decode to read. Edit the plain text. Encode again only if the destination is HTML. Leaving decoded text in a Markdown doc is fine; Markdown has its own rules for raw HTML blocks. Markdown preview before publishing a README helps when the file mixes both.
Walkthrough: encode and decode on Toolsy
Open HTML entities. Paste the plain string with & or <. Encode and copy the result into your template. To clean a messy feed title, paste the entity soup, decode, and copy the readable text. Everything runs locally in your browser with no upload.
Use URL encode when the job is a query parameter, not an HTML body. Different vocabulary, different tool. URL encode characters for query strings covers that path. Email HTML images and data URLs may need Base64 instead; see Base64 encode for email HTML data URLs.
How to check results without breaking the page
Preview in the CMS, not only in the paste box. Confirm ampersands render as & on the page, not as & visible to readers (visible & usually means double encoding or a theme that escapes twice). Confirm comparisons show < rather than swallowing the rest of the line.
Failure modes
Double encoding: decode until readable, then encode a single time. Wrong tool: URL encoding inside HTML bodies produces %26 where readers expect &. Stripping all entities by hand in Word often reintroduces smart quotes; prefer the dedicated encode step for HTML destinations.
Related jobs for editors
Query strings: URL encode. Hidden Unicode in tables: Hidden Characters. Placeholder layout text: lorem ipsum and Is lorem ipsum still useful in 2026?. Email image embedding: Base64 guide above.
Engineering teams still own context-aware sanitization for untrusted user content in apps. This cheat sheet is for editorial HTML snippets, not a substitute for a security review of an application template.
Limits and honesty
HTML entities encodes and decodes in the browser for free with no daily AI quota. It does not audit XSS across every framework. Encoding helps keep markup intact; it is not a full sanitizer for script-bearing input in every context. Prefer framework escaping for app UI and use this tool for snippets and teaching.
Huge binary payloads do not belong in an entity tool. Keep to text titles, blurbs, and small HTML fragments.
Frequently asked questions
What is & in HTML?
It is the encoded form of the ampersand character &. Browsers show & to readers when the HTML source contains &. Writers meet it in company names and anywhere a bare & would start an entity by mistake.
When should I HTML encode CMS text?
Encode when you paste into HTML source fields, email HTML modules, or static snippets where <, >, or & would break markup. Skip extra encoding when your CMS already escapes on save and the preview looks correct. When unsure, encode a copy in HTML entities and compare previews.
Can I encode and decode on one Toolsy page?
Yes. HTML entities supports both directions. Encode plain text to entities, or decode entities back to readable characters. Use that for feed cleanup and for preparing snippets.
Is the HTML entities tool free?
Yes. No account and no daily limit for this browser tool. Nothing you paste is uploaded for the encode or decode step on that page.
HTML entities vs URL encode: which do I use?
Use HTML entities for HTML bodies and CMS HTML fields. Use URL encode for query strings and parameters in links. Mixing them produces ugly, wrong output in both places.
Why do I see &amp; in a title?
The string was encoded twice. Decode until you see a single & in the plain text, then encode once for the HTML destination. Fix the export pipeline if every title arrives double encoded.
Do I need to encode every Unicode character?
No. Modern UTF-8 pages can hold most characters directly. Focus on &, <, >, and quotes in attribute contexts. Use entities for symbols when a legacy editor corrupts raw Unicode on save.
Will HTML encode stop all XSS?
No. Encoding is one defense for putting text into HTML. Applications need context-aware escaping and sanitization designed by engineers. Editors should still encode risky characters in snippets so templates do not break; treat security-sensitive untrusted input as an engineering problem.
What about in copy meant for spreadsheets?
Non-breaking spaces can look like normal spaces and then break CSV joins. Decode or replace them before data work. Use Hidden Characters when a cell refuses to match a join key.
Does encode upload my snippet to Toolsy?
No. Encode and decode stay on your device for this tool. Draft markup and sample payloads remain local until you paste them into your CMS or email vendor.
For query-string work next, open URL encode characters for query strings. For email HTML images, keep Base64 encode for email HTML data URLs nearby.
HTML encode and decode entities
Turn < and & into safe entities, or decode entities back to plain text. Free in your browser, nothing uploaded.
