urltoolskit.org
URL utilities, in the browser
Say hi →

HTML entities in URLs

repair & and ? in copied links · or escape a URL for an attribute

A URL copied out of HTML source, an XML feed or an email often arrives as ?a=1&b=2. That extra amp; is HTML escaping, not part of the URL, and it breaks the second parameter. Paste the link here to strip the entities back out — or flip the direction to escape a URL for safe use inside an href.

What changed

Ready.

How to use

  1. Paste the URL into the input. The result updates as you type.
  2. Leave Direction on Decode entities to clean up a link you copied from HTML source.
  3. Switch to Escape URL when you are writing HTML and need the URL to be a valid attribute value.
  4. Check the What changed table — it lists every entity that was replaced and how many times, so nothing is silently rewritten.
  5. Click Copy result.

Which entities are handled

Named entities that legitimately turn up inside URLs (&amp;, &lt;, &gt;, &quot;, &apos;, &nbsp;, &sol;, &quest;, &num;, &percnt;, &equals; and about twenty more), plus every numeric reference in decimal (&#63;) and hexadecimal (&#x3F;) form. Escaping goes the other way for the five characters that matter in markup: &, <, >, " and '.

Decoding is done with an explicit lookup table rather than by assigning the string to an element, so no markup from your input is ever parsed or executed.

FAQ

Should URLs in HTML contain &amp;?

Yes — in HTML source, & inside an attribute value must be written &amp; to be valid. The browser un-escapes it before requesting the URL. The entity only becomes a bug when the escaped form leaks out of HTML into a place that expects a raw URL: a config file, a cURL command, an API payload.

My URL has &nbsp; in it and still breaks.

Decoding &nbsp; gives you U+00A0, a non-breaking space — invisible, but not a plain space and not legal in a URL. Run the result through the byte inspector to spot it, then delete or percent-encode it.

What about percent-encoding?

Different layer, different tool. HTML entities are markup escaping; %XX is URL escaping. A link can need both fixed — do entities here, then use the URL encode / decode tool.

Are unknown entities left alone?

Yes. Anything not in the table and not a valid numeric reference is passed through untouched rather than guessed at.