Recommended Free Tools
To represent a Unicode character in HTML, use a named reference such as é, a decimal numeric reference such as é, or a hexadecimal numeric reference such as é. Each represents “é.” But you usually do not need to convert Unicode text: for ordinary page content, use UTF-8 and write the characters directly. Escape only when the HTML context requires it, and use context-appropriate encoding for untrusted input.
Three ways to write an HTML character reference
HTML character references are part of HTML syntax. The WHATWG HTML Standard describes named references and numeric references, which can use either decimal or hexadecimal notation. In the forms shown here, retain the terminating semicolon.
As an Amazon Associate I earn from qualifying purchases.
| Form | Example for “é” | What it means |
|---|---|---|
| Literal Unicode | é |
The character itself, normally suitable in UTF-8 HTML text. |
| Named reference | é |
A symbolic name for the character, where that name is defined. |
| Decimal numeric reference | é |
Decimal code point 233, equivalent to U+00E9. |
| Hexadecimal numeric reference | é |
Hexadecimal code point E9, also U+00E9. |
Named references can be easier to recognize for familiar symbols. Numeric references are useful when you know the code point or do not have a suitable named form. The W3C HTML 4.01 specification explains the equivalent decimal and hexadecimal forms; the current WHATWG syntax defines reference parsing and restrictions on numeric references.
Do you need to convert Unicode text to entities?
For normal multilingual page text, generally no. The Unicode Consortium advises, “You should always use UTF-8,” and says modern browsers handle characters as Unicode internally. Set the document’s character encoding to UTF-8 and include ordinary characters directly rather than turning every non-ASCII character into an entity. See the Unicode Consortium’s web FAQ.
#1 Best Overall
Use a character reference when you specifically need an ASCII-only representation, when literal insertion is inconvenient in the markup, or when a character must be represented without being read as markup. For example, write a literal less-than sign as < and an ampersand as & when they would otherwise be interpreted as markup syntax or the start of a reference. The right choice depends on the exact parsing context, not on whether a character is Unicode.
Convert a known character to a numeric reference
- Find the character’s Unicode code point. For “é,” it is U+00E9.
- Choose a numeric base. U+00E9 is decimal 233 or hexadecimal E9.
- Write the reference with its prefix and semicolon. Use
éfor decimal oréfor hexadecimal.
If a suitable named reference is more readable, use that instead—for “é,” é. For ordinary text in UTF-8 HTML, the direct character é is usually simplest.
Rank #2
Escape text safely in Python
When producing HTML text from a string, Python’s standard-library html.escape() handles ampersands and angle brackets; by default, it also escapes single and double quotation marks:
import html
safe_text = html.escape(user_text) # quote=True by defaultPython’s html.unescape() decodes named and numeric references according to HTML5 rules. Escaping and unescaping do different jobs: do not decode untrusted text and then insert it into markup without applying the encoding appropriate to its destination. See the Python 3.14 HTML support documentation.
Rank #3
HTML escaping is not a universal security fix
Escape for the context where a value will be interpreted. Text content, HTML attributes, URLs, CSS, and JavaScript do not all use the same rules. OWASP recommends context-aware output encoding; the choice between named and numeric HTML references does not make an unsafe destination safe.
- For page text in JavaScript, prefer a safe DOM sink such as
textContent, which treats the value as text rather than parsing it as HTML. - For attributes, quote the value and use the appropriate attribute encoder.
- For event-handler attributes, do not place untrusted values in attributes such as
onclick. The browser parses and decodes HTML references before interpreting the JavaScript, so HTML attribute encoding alone does not secure the nested JavaScript context. Use event listeners instead.
These practices follow the context-specific guidance in OWASP’s Cross Site Scripting Prevention Cheat Sheet.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Avoid double-encoding and hand-written conversions
Do not encode text that has already been escaped without knowing how it will be rendered: repeated escaping can turn visible characters such as & into text like &. OWASP’s application security verification guidance recommends encoding at render time rather than storing escaped output, which helps avoid double-encoding problems.
Free tools Windows power users keep installed
One-click scans. No signup required.
Prefer a standards-aware library over a chain of manual replacements, particularly for user input or decoding references. A replacement sequence can mishandle an ampersand or characters that have special meaning in a particular context; HTML-aware utilities provide a more reliable starting point, though they do not replace context-specific security handling.
Quick Recap
Best Value
- Used Book in Good Condition
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
