Home › Encoding & Decoding › HTML Entity Encoder / Decoder
HTML Entity Encoder & Decoder
Turn markup-significant characters into entities, and read them back.
🔒 Runs in your browser. Nothing is uploaded — verify it in the network panel, or disconnect and try again.
The five you must always escape
| Character | Named entity | Numeric | Why it matters |
|---|---|---|---|
& | & | & | Starts every entity — escape it first, or you create phantom entities |
< | < | < | Opens a tag |
> | > | > | Closes a tag; needed mainly to avoid ]]> sequences |
" | " | " | Ends a double-quoted attribute |
' | ' (there is no ' in HTML4) | ' | Ends a single-quoted attribute |
Escape the ampersand first when writing an encoder, or you will double-escape the entities you just generated: < becomes &lt; and renders as visible text <.
Named versus numeric references
- Named entities (
,—,©,€) are readable and cover the 2,000-plus characters of HTML5's list. - Decimal numeric (
—) and hex numeric (—) work for any Unicode code point and need no name lookup — the safest choice when you only need a handful of characters. - Do not hand-roll a name table.
'works in XHTML and HTML5 but not in HTML4, and browsers have historically been inconsistent about which malformed entities they forgive.
Where entity encoding is genuinely necessary
- You are generating HTML by string concatenation and a user value lands in a text node or attribute.
- You are displaying source code, so
<script>must appear as visible text. - You are writing an email template, where strict MIME parsers will reject unmatched
<. - You are embedding text in an SVG or XML file, where the five rules are the same but
is undefined.
Entity encoding is context-dependent, not universal. A value inside <script>, inside a CSS url(), or inside an unquoted attribute needs different treatment. The robust pattern is to write the value as data and let a template engine — or textContent in the DOM — do the escaping, rather than filtering the string on the way in.
How to use it
- Paste the text or HTML you want to convert.
- Encoding produces display-safe entities; decoding turns references back into characters.
- Choose whether to escape only the five critical characters or every non-ASCII character too.
- Copy the result.
Worth knowing
- HTML5 defines over 2,000 named character references.
- Ampersand must be escaped before angle brackets in any encoder.
'is undefined in HTML4 but valid in HTML5 and XHTML.- Numeric references accept decimal (
—) and hex (—) forms.
Limitations
- Entity-encoding is not sufficient XSS protection — the danger depends on the HTML context.
- Encoding a whole document would also encode its tags, turning markup into visible source.
- Some decoders silently drop unknown entities rather than reporting them.
- JSON is not HTML: inside JSON,
<needs no escaping at all.
Frequently asked questions
Is entity encoding enough to prevent XSS?
Only for the specific context of an HTML text node or a quoted attribute. Inside
<script>, in a URL, or in a CSS context different escaping applies, and the safest approach is to let a template engine or DOM text node handle it.What is `&amp;`?
A double-escaped ampersand: it renders as the visible text
&. It is the signature of text that has passed through two encoders, one of which escaped the ampersand produced by the other.What is ` `?
A non-breaking space (U+00A0). It prevents a line break between two words, which is what you want in
10 kg or Dr. Smith, and it is a real character rather than ordinary whitespace.Should I escape non-ASCII characters?
Usually not. UTF-8 handles them directly, and escaping every accented letter hurts readability and file size. It is worth doing only when the output must survive a strictly ASCII-only channel.
Related tools
URL Encoder / DecoderBase64 Encoder / DecoderJSON Formatter & ValidatorXML to JSON ConverterJWT DecoderHex Encoder / Decoder
Keep reading