HTML Entity Encoder / Decoder

How to Use the HTML Entity Encoder

1. Paste raw text or HTML into the Plain Text panel to encode it — the tool converts <, >, &, quotes, and slashes to HTML entities in real time.
2. Paste already-encoded HTML into the Encoded HTML Entities panel to decode it back into plain text.
3. Click Encode → or ← Decode to run a conversion manually, or use the copy buttons to grab the result.

What Are HTML Entities?

HTML entities are escape codes that represent reserved or special characters in HTML. Characters like <, >, and & have structural meaning — they open tags, close tags, and start entity references — so they must be escaped when you want them to render as visible text.

Every entity has two forms:

• Named: &, <, © — readable but limited to a fixed set of names.
• Numeric: & (decimal) or & (hex) — works for any Unicode code point.

The Five Characters You Must Always Encode

When to Encode HTML

• User-generated content. Always encode before inserting into HTML to prevent XSS (cross-site scripting). This is the most common and most dangerous HTML injection vector.
• Code blocks and documentation. When showing HTML inside a <pre> or <code> tag, the markup itself needs to be encoded so the browser renders it as literal text instead of real tags.
• Email newsletters. HTML emails often need encoded entities for characters like ©, ®, ™, and curly quotes.
• JSON embedded in HTML. If you ship a JSON blob inside a <script> tag, escape </ to avoid breaking out of the script context.

HTML Encoding and XSS Prevention

HTML encoding is the first line of defense against cross-site scripting (XSS). If you render user input directly into HTML without encoding, an attacker can inject a <script> tag that runs on every visitor's browser — stealing cookies, session tokens, or rewriting the page. Encoding converts <script> into <script>, which renders harmlessly as text.

Real-world apps almost always delegate encoding to their framework:

• React / Vue / Svelte — automatic when you use {variable} or {{variable}} syntax.
• Handlebars / Mustache — {{variable}} is escaped; {{{variable}}} is raw (dangerous).
• Server-side templates — most (Jinja2, Liquid, ERB) auto-escape by default but can be disabled per tag.

Use this tool when you need to encode a literal string by hand or debug a template that isn't auto-escaping.

Named vs Numeric Entities

Named entities (©) are easier to read in source code. Numeric entities (©) work for every Unicode code point — including emoji and non-Latin characters that have no named form. Both render identically in the browser; use whichever is more convenient.

Related Developer Tools

Need to encode URLs or Base64 instead? Try the URL encoder and Base64 encoder. For shrinking stylesheets, use the CSS minifier.