What are HTML entities?

HTML entities are special codes that represent characters like , &, and quotes. They prevent browsers from interpreting them as HTML code.

When should I encode HTML?

Encode HTML when displaying user-generated content to prevent XSS attacks, or when you need to show HTML code as text on a webpage.

What's the difference between named and numeric entities?

Named entities use names (< for <) and are more readable. Numeric entities use codes (<) and work for any Unicode character.

Can I decode entities?

Yes! Paste text with HTML entities and click Decode to convert them back to regular characters.

Does it work with special characters?

Absolutely! The tool handles all special characters including quotes, apostrophes, copyright symbols, and accented letters.

HTML Entity Encoder

Encode and decode HTML entities.

Enter text to see conversion

HTML entities are special character sequences that begin with an ampersand (&) and end with a semicolon (;). They serve two critical purposes: displaying reserved HTML characters as literal text rather than code, and representing characters that aren't easily typed on standard keyboards.

Without HTML entities, browsers would interpret characters like < and > as HTML tag delimiters. For example, typing "<script>" directly in HTML would create an actual script tag. By encoding it as "<script>", the browser displays the literal text instead.

Common examples include:

< for < (less than)
> for > (greater than)
& for & (ampersand)
" for " (quotation mark)
' for ' (apostrophe)
© for © (copyright)
  for non-breaking space

Encode HTML: Paste your HTML or text containing special characters in the input field. Click "Encode" to convert special characters to HTML entities.
Decode HTML: Paste encoded HTML entities and click "Decode" to convert them back to their original characters.
Auto-detection: The tool automatically handles both named entities (©) and numeric entities (©).
Copy results: Use the copy button to quickly copy the encoded or decoded output to your clipboard.
Batch processing: Process multiple lines or large blocks of text at once.

HTML entity encoding is a critical defense against Cross-Site Scripting (XSS) attacks, one of the most common web security vulnerabilities.

🚨 Unsafe Code (Vulnerable to XSS)

<div>${userInput}</div>

If userInput contains "<script>alert('XSS')</script>", it will execute!

✅ Safe Code (Properly Encoded)

<div>${encodeHTML(userInput)}</div>

Malicious scripts are displayed as harmless text: "<script>..."

Critical Rule: Always encode user-generated content before displaying it in HTML. This includes comments, usernames, form submissions, URL parameters, and any data from external sources.

Essential Entities (Must-Know)

< → <

> → >

& → &

" → "

' → '

  → (space)

Common Symbols

® → ®

™ → ™

€ → €

£ → £

¥ → ¥

Math & Typography

× → ×

÷ → ÷

± → ±

≠ → ≠

≤ → ≤

≥ → ≥

HTML entities come in two formats:

Named Entities

Easy to remember, descriptive names:

©   < > &

✅ More readable in source code

❌ Limited to predefined entities (~250 total)

Numeric Entities (Decimal)

Use Unicode code points with &#:

©   < > &

✅ Can represent any Unicode character

❌ Less readable

Numeric Entities (Hexadecimal)

Use Unicode code points with &#x:

©   < > &

💡 Commonly used in technical documentation

All three formats produce identical results. Choose based on your needs: readability (named), universality (numeric), or convention (hex for technical docs).

Display HTML Code: Show HTML tags as text on a webpage for tutorials, documentation, or code examples.
Prevent XSS Attacks: Sanitize user input to prevent malicious scripts from executing (critical for security).
Email Templates: Ensure special characters display correctly in HTML emails across different email clients.
XML/RSS Feeds: Encode content for XML compatibility, as XML is stricter about special characters than HTML.
Database Storage: Store HTML content safely without corruption from special characters.
SEO & Meta Tags: Properly encode special characters in meta descriptions and Open Graph tags.
JSON in HTML: Embed JSON data in HTML attributes safely using entity encoding.

Modern HTML supports Unicode directly, but entity encoding can be useful for compatibility or when special characters cause issues.

Emoji as Entities

Emoji can be encoded using their Unicode code points:

😀 → 😀 (grinning face)

💥 → 💥 (collision)

🔥 → 🔥 (fire)

⚡ → ⚡ (lightning)

Note: Most modern browsers support emoji directly in UTF-8 encoded HTML, so entity encoding is optional. Use entities when you need guaranteed compatibility with older systems.

Output encoding: Always encode user input before displaying it in HTML—this is output encoding, not input validation.
Context matters: Encoding requirements differ for HTML content, attributes, JavaScript, and URLs. Use appropriate encoding for each context.
Don't double-encode: Encoding already-encoded entities creates broken output. Check if content is already encoded before processing.
Use UTF-8: Set charset to UTF-8 in your HTML to directly support international characters without extensive entity encoding.
Framework helpers: Use built-in encoding functions from your framework (React automatically escapes, but server-side templates may not).
Database storage: Store original content in database, encode only when displaying. This maintains data integrity.
Testing: Test with malicious input like "<script>alert('XSS')</script>" to verify your encoding works.

You might also need

🔗

URL Encoder

Encode/decode URLs

→ Web encoding

📄

JSON Formatter

Format and validate JSON

→ JSON in HTML

🔍

Regex Tester

Test regular expressions

→ Test HTML patterns

Browse all tools

HTML Entity Encoder

What are HTML Entities?

How to Use This Tool

XSS Prevention & Security

🚨 Unsafe Code (Vulnerable to XSS)

✅ Safe Code (Properly Encoded)

Common HTML Entities Reference

Essential Entities (Must-Know)

Common Symbols

Math & Typography

Numeric vs Named Entities

Named Entities

Numeric Entities (Decimal)

Numeric Entities (Hexadecimal)

Common Use Cases

Unicode & Emoji

Emoji as Entities

Best Practices

You might also need

URL Encoder

JSON Formatter

Regex Tester