HTML Entity Encoder / Decoder
Encode special HTML characters to entities and decode HTML entities back to readable text.
Common HTML Entities
| Character | Entity | Name |
|---|---|---|
| & | & | Ampersand |
| < | < | Less than |
| > | > | Greater than |
| " | " | Double quote |
| ' | ' | Single quote |
| © | © | Copyright |
| ® | ® | Registered |
| ™ | ™ | Trademark |
| € | € | Euro |
| £ | £ | Pound |
| ¥ | ¥ | Yen |
| | Non-breaking space |
About the HTML Entity Encoder / Decoder
HTML entities are special character sequences that represent reserved XML/HTML characters. For example, '<' becomes '<' and '>' becomes '>'. Encoding is essential when displaying code snippets in web pages, preventing XSS attacks, and embedding special characters in HTML content. Our encoder/decoder handles all common HTML entities safely and accurately.
What Is HTML Entity Encoder / Decoder?
In HTML, characters such as '<', '>', '&', and '"' have special meaning: '<' starts a tag, '&' starts an entity or character reference, and quotes delimit attribute values. If you want to display these characters as literal text rather than have the browser interpret them as markup, you must replace them with HTML entities — '<' for '<', '>' for '>', '&' for '&', '"' for '"', and ''' or ''' for "'". This process is also called escaping. Escaping is the cornerstone of cross-site scripting (XSS) defense: any time you insert untrusted data into an HTML document, you must escape it first so an attacker cannot inject a '<script>' tag. Entities also let you insert characters that are hard to type, such as '©' for © or ' ' for a non-breaking space. Decoding reverses the process, turning entities back into their literal characters.
How to Use
- Paste your text into the input field above.
- Click 'Encode' to convert special characters (&, <, >, ", ') into HTML entities.
- Click 'Decode' to convert HTML entities back to readable text.
- Copy the result using the Copy button.
- A reference table below shows common HTML entities and their corresponding characters.
Common Use Cases
- Displaying code snippets and HTML examples in a tutorial without the browser rendering them
- Escaping user-generated content to prevent cross-site scripting (XSS)
- Inserting special symbols such as ©, ™, or non-breaking spaces into content
- Preparing text for XML documents where certain characters are reserved
- Decoding entities scraped from web pages back into readable text
Examples
<script>alert('xss')</script> <script>alert('xss')</script>
Escaped output is safe to display as text in any HTML page.
Tips & Best Practices
- HTML encoding is different from URL encoding — use the appropriate tool for your use case.
- Encoding is critical when displaying user-submitted content to prevent cross-site scripting (XSS).
- Named entities (like & for &) are more readable than numeric entities (like & for &).
- This tool is useful for bloggers, forum moderators, and web developers working with user-generated content.
Frequently Asked Questions
Which characters does the encoder escape?
The five characters that matter for HTML and XML safety: '&' (&), '<' (<), '>' (>), '"' ("), and "'" ('). Escaping these five is sufficient to make text safe to insert into an HTML element's content or a quoted attribute value.
Is HTML encoding enough to prevent XSS?
It is the primary defense when inserting text into HTML element content or a quoted attribute. It is not sufficient for other contexts such as inside a <script> block, a style attribute, or a URL attribute — those need context-specific escaping. Always also use HTTPS and a strong Content Security Policy.
What is the difference between named and numeric entities?
Named entities like '&' use a human-readable name. Numeric entities like '&' (decimal) or '&' (hex) use the character's Unicode code point. They render identically; named entities are easier to read and numeric entities work for any Unicode character.
How does this differ from URL encoding?
HTML entity encoding makes text safe inside an HTML document. URL encoding (percent-encoding) makes text safe inside a URL. They are not interchangeable — use the HTML Entity Encoder for page content and the URL Encoder for links and query strings.
This html entity encoder / decoder runs entirely in your browser. No data is uploaded to any server. Your privacy is completely protected.
Related Tools
URL Encoder / Decoder
Encode special characters for URLs or decode percent-encoded URLs back to readable text.
Base64 Encoder / Decoder
Encode text to Base64 or decode Base64 strings back to plain text. Supports UTF-8 and binary data.
Markdown Previewer
Write and preview Markdown in real-time. See how your Markdown renders as HTML instantly.
Case Converter
Convert text to uppercase, lowercase, title case, sentence case, camelCase, snake_case, and more.