Encoding
HTML Entities Encode/Decode
Encode and decode HTML entities — safely display special characters on a page.
HTML entities are a way to write characters that would otherwise break markup (<, >, &) or have no keyboard key, as safe text sequences like < or &. This tool encodes and decodes such entities right in your browser.
How to use it
- Encode: paste text and characters like <, >, &, and quotes get replaced with their matching entities.
- Decode: paste HTML containing entities (&, ©, etc.) to see the plain text.
- Both named entities (&) and numeric ones (& or &) are supported.
Common uses
- Safely displaying user text (a comment, a message) on a page without risking broken markup or an injected script.
- Embedding HTML code samples in an article or documentation so the browser shows them as text instead of rendering them.
- Decoding content copied from another site where the characters arrived already entity-encoded.
Things to keep in mind
HTML entity escaping only protects against XSS via a page's text content — it does not protect a JavaScript context (innerHTML, eval) or href/src attributes containing unvalidated URLs.
Encode exactly at the point where text gets inserted into HTML, not ahead of time when saving to a database — otherwise the data gets mangled when reused outside an HTML context.
Article about this tool: HTML Entities: how to safely output special characters on a page
Frequently asked questions
What's the difference between named and numeric HTML entities?
Named entities like & are easier to read, while numeric entities like & or & (decimal or hex) work for any character, including ones without a named entity. Both render identically in a browser.
When do I actually need to encode HTML entities?
Encode characters like < > & " ' whenever you're inserting user-provided or dynamic text into HTML markup, so the browser treats them as text rather than as part of a tag or attribute.
What's the difference between "Basic" and "All characters" mode?
Basic only escapes the characters that are structurally significant in HTML (like < > & " '), while "All characters" also converts other non-ASCII characters to numeric entities, which can be useful for older or strict parsers.
Do I need to escape text in an attribute differently than in the page body?
The core characters (<, >, &) are escaped the same way, but inside a quoted attribute it's also critical to escape the specific type of quote the attribute is delimited by — otherwise the value will "break" earlier than expected.
Does HTML escaping protect against all kinds of XSS?
No. It closes off the most common vector — inserting text into HTML content — but it doesn't protect against XSS through a JavaScript context (for example, innerHTML followed by code execution) or unvalidated URLs in href/src.