HTML entity encoder / decoder
Encode and decode HTML entities
Paste text containing characters like <, >, &, or quotes to see them encoded.
This tool runs entirely in your browser. Your text is never uploaded or sent to a server.
About this tool
HTML entities are special character sequences that represent characters which would otherwise be interpreted as HTML markup — for example, `&` for `&` and `<` for `<`. Encoding user-supplied content before inserting it into HTML prevents cross-site scripting (XSS) vulnerabilities. Decoding reverses the process, converting entity sequences back to their original characters, which is useful when processing HTML content programmatically or when inspecting encoded strings.
Common uses
- › Encoding user input before rendering it in HTML to prevent XSS
- › Converting special characters for use in HTML attributes
- › Preparing content for safe inclusion in HTML documents
- › Decoding HTML-encoded strings returned by an API or scraper
- › Inspecting encoded HTML from email templates or legacy systems
Example
<p>Tom & Jerry's "Adventures"</p><p>Tom & Jerry's "Adventures"</p>Technical notes
- › Encoding replaces reserved HTML characters (<, >, &, quotes) with their named or numeric entity equivalents so browsers render them as literal text instead of markup.
- › Encoding untrusted input before inserting it into HTML is a core defense against cross-site scripting (XSS) — but it is not a complete substitute for proper input validation and context-aware escaping in your application.
- › Decoding does not execute or evaluate any code; it purely converts entity sequences back into their literal characters as text.
FAQ
Does encoding HTML entities prevent all XSS attacks?
It helps significantly for content inserted into HTML text, but full XSS protection depends on context — attributes, JavaScript, and URLs each need their own escaping rules beyond basic HTML entity encoding.
What's the difference between named entities and numeric entities?
Named entities like & are easier to read; numeric entities like & use a Unicode code point and work even for characters without a common name. Both render identically in a browser.
Why does my encoded text still show angle brackets?
If you're viewing the encoded output inside another HTML-rendering context (like a browser preview), the entities will display as their original characters — copy the raw text to see the actual entity codes.