HTML Entity Encoder

Encode special characters as HTML entities or decode entities back to characters. Essential for preventing XSS and displaying code.

100% client-side No signup Free forever

Common HTML Entities

&&
<&lt;
>&gt;
"&quot;
'&#39;
 &nbsp;
©&copy;
®&reg;
// how to use

How to Use HTML Entity Encoder

  1. Select encode or decode mode
  2. Paste your text in the input area
  3. View the converted output instantly
  4. Copy the result to use in your code
// about

About HTML Entity Encoder

HTML uses special characters like <, >, and & for markup structure. When you need to display these characters as text (or include user input safely), they must be encoded as HTML entities. Our encoder handles this conversion correctly and securely.

Why Encoding Matters

HTML encoding serves two critical purposes:

  • Security: Prevents cross-site scripting (XSS) attacks by neutralizing malicious HTML/JavaScript in user input
  • Display: Allows literal <, >, & characters to appear in HTML content without being interpreted as markup

Characters That Require Encoding

The essential characters to encode are: < (less than), > (greater than), & (ampersand), " (double quote), and ' (apostrophe). These become &lt;, &gt;, &amp;, &quot;, and &#39; respectively. Additional characters like non-breaking spaces and special symbols can also be encoded.

When to Encode

Always encode user-generated content before inserting it into HTML. This includes form inputs, comments, usernames, and any data that originates from users. Encode when displaying code snippets in web pages. Encode when building HTML strings dynamically in JavaScript.

Decoding Use Cases

Decoding is useful when processing HTML content from external sources, migrating content between systems, or extracting text from HTML for plain-text contexts. The decoder reverses both named entities (&amp;) and numeric entities (&#60;).

// faq

Frequently Asked Questions

What is HTML entity encoding?
HTML encoding converts characters to their entity equivalents: < becomes &lt;, > becomes &gt;, & becomes &amp;. This prevents characters from being interpreted as HTML markup, avoiding display issues and security vulnerabilities like XSS attacks.
When should I encode HTML entities?
Encode when displaying user-generated content in HTML, showing code examples, including special characters in attributes, or when characters might break HTML structure. Always encode user input before display to prevent XSS attacks.
What is the difference between named and numeric entities?
Named entities use descriptive names: &copy; for ©, &nbsp; for non-breaking space. Numeric entities use Unicode code points: &#169; or &#x00A9; for ©. Numeric entities work for any character; named entities exist only for common ones.
Should I encode all characters or just reserved ones?
Minimum: encode <, >, &, ", and '. This prevents HTML injection. Full encoding converts all non-ASCII characters to entities. Full encoding ensures compatibility with any encoding setting but creates larger output. Choose based on your needs.
How do I decode HTML entities?
Our tool decodes as well: paste encoded HTML (&lt;p&gt;) to get decoded output (<p>). Useful for reading escaped content, fixing double-encoding issues, or converting entity-heavy text to readable form.
What about JavaScript string encoding?
When putting content into JavaScript strings, additional escaping is needed: backslash, quotes, and newlines. Use JSON.stringify() for proper escaping, or our dedicated JavaScript string escaper. HTML encoding alone isn't sufficient for JS contexts.