Advertisement
Guide
About the HTML Entity Encoder / Decoder
A few characters have special meaning in HTML — < and > delimit tags, & starts an entity, and quotes delimit attributes. To display those characters as literal text rather than have the browser interpret them, you replace them with HTML entities like <, >, and &. This tool escapes text into entities and decodes entities back to plain characters.
It handles the essential named entities, decodes numeric entities, and can optionally encode every non-ASCII character as a numeric entity for maximum compatibility. Everything runs in your browser.
Why escaping matters for security
Displaying untrusted text — a username, a comment, search input — directly in a page without escaping is the root of cross-site scripting (XSS). If someone enters <script>and it isn't escaped, the browser runs it. Escaping <, >, and &turns that into harmless visible text. Modern frameworks escape by default, but knowing the mechanism helps you spot where it's missing.
Named vs. numeric entities
Named entities like © are readable, while numeric entities like © reference a character by its code point and always work even for characters without a name. Encoding all non-ASCII as numeric entities guarantees your markup survives systems with limited character-set support.
How to use it
- 1Choose Encode to escape text, or Decode to unescape entities.
- 2Paste your text or HTML into the input.
- 3Optionally encode all non-ASCII characters for maximum compatibility.
- 4Copy the result into your HTML or template.
Frequently asked questions
What is an HTML entity?
A code that represents a character, used so that reserved characters display as text rather than being interpreted as markup. Examples are < for <, & for &, and © for the copyright symbol.
Which characters must I escape in HTML?
At minimum < , > , and & in text content, plus quotes inside attribute values. Escaping these prevents the browser from misreading your content as markup.
How does escaping prevent XSS attacks?
By converting characters like < into <, untrusted input can no longer form live HTML or script tags — it is shown as literal text instead of executed.
What is the difference between named and numeric entities?
Named entities use a word (©) and are easier to read; numeric entities reference a code point (©) and work for any character, even those without a name.
Is my input uploaded?
No. Encoding and decoding happen entirely in your browser.