๐ HTML Entities
Encode and decode HTML entities free online. Escape special characters safely and prevent XSS. Browser-based, no upload.
๐ HTML Entities
๐ง Loading toolโฆ
About the HTML Entities Tool
Certain characters cannot appear literally in HTML. An unescaped < starts a tag, an unescaped & starts an entity, and either one can break your page or, worse, allow injected markup to execute. Entity encoding replaces them with safe equivalents like < and & that display correctly without being parsed as markup.
This matters most for user-supplied content, which is the classic cross-site scripting vector. Encoding is also what you need when displaying code samples on a page โ otherwise your example markup renders instead of showing. Encoding and decoding both run in your browser.
How to Use HTML Entities
- Paste your text or HTML into the input area.
- Choose whether to encode special characters or decode existing entities.
- Press Convert.
- Copy the safely escaped or decoded output.
When to Use This Tool
- Escaping user input before rendering it in a page
- Displaying code samples in documentation without them rendering
- Encoding special characters for HTML email templates
- Decoding entity-encoded content pulled from an API or feed
- Preventing markup injection in a comment or forum system
Things Worth Knowing
- The critical characters to escape are <, >, &, ", and '.
- Encoding is not a substitute for proper server-side sanitisation in security-critical contexts.
- Numeric entities such as < and named entities such as < are equivalent.
Quick Facts
| Tool name | HTML Entities |
| Category | Developer Tools |
| Price | Free โ no account, no trial, no watermark |
| Where it runs | Entirely in your browser (client-side) |
| Files uploaded | None โ your data never leaves your device |
| File size limit | None imposed; limited only by device memory |
| Works offline | Yes, once the page has loaded |
| Platforms | Windows, macOS, Linux, Android, iOS |
Frequently Asked Questions
Which characters must always be escaped?
Less-than, greater-than, and ampersand at minimum, since they carry structural meaning. Inside attribute values, quotes must be escaped as well.
Does entity encoding prevent XSS?
It is an essential part of the defence, but context matters โ content inside a script block or a URL attribute needs different escaping. Encoding alone is not a complete solution.
What is the difference between named and numeric entities?
Named entities like © are readable; numeric ones like © work for any Unicode character regardless of whether a name exists. Both render identically.
Do I need to encode non-English characters?
Not if your page declares UTF-8, which handles Devanagari, Arabic, Chinese, and emoji natively. Encoding them is only necessary in legacy encoding contexts.