HTML Entity Encoder & Decoder
Encode HTML special characters to entities or decode entities back to characters. Prevent XSS and display HTML safely.
What is HTML Entity Encoder?
An HTML entity encoder converts special characters into their HTML entity equivalents so they display correctly on web pages without being interpreted as HTML code. Characters like <, >, &, and " have special meaning in HTML — if you want to display them as visible text rather than markup, they must be encoded as <, >, &, and ". This tool also handles the reverse — decoding entity strings back to readable characters for editing.
How It Works
The encoder scans your input character by character, identifying characters that have reserved meanings in HTML. It replaces each with the corresponding named entity (like &) or numeric entity (like &). The decoder does the reverse — recognizing entity patterns and converting them back to the original characters. Both named entities (like © for ©) and numeric entities (decimal and hexadecimal) are supported.
Quick Reference
| Character | Named entity | Numeric | Why it matters |
|---|---|---|---|
| & | &amp; | &#38; | Must be encoded first, or you double-encode |
| < | &lt; | &#60; | Otherwise parsed as the start of a tag |
| > | &gt; | &#62; | Closes a tag unexpectedly |
| " | &quot; | &#34; | Breaks out of a double-quoted attribute |
| ' | &apos; | &#39; | Breaks out of a single-quoted attribute |
| non-breaking space | &nbsp; | &#160; | Will not collapse or wrap |
Common Use Cases
- •Preparing code examples for display on web pages without the browser interpreting tags
- •Encoding user-generated content before inserting it into HTML to prevent XSS attacks
- •Converting special characters in database content for safe HTML output
- •Decoding HTML entities in API responses or scraped content back to readable text
- •Preparing email template content where special characters need entity encoding
- •Encoding characters for use in XML documents and RSS feeds
Frequently Asked Questions
Which characters are encoded?▼
The five HTML special characters: & < > " ' are converted to their entity equivalents.
Which characters must always be encoded in HTML?▼
Five: `&` becomes `&`, `<` becomes `<`, `>` becomes `>`, `"` becomes `"` and `'` becomes `'`. The ampersand must be encoded first, otherwise you double-encode the entities you are about to create.
What is the difference between a named and a numeric entity?▼
A named entity is readable (`©`) but only exists for a defined list of characters. A numeric entity references the code point directly in decimal (`©`) or hexadecimal (`©`) and works for any character. Numeric entities are the safer choice for unusual symbols.
Why is my text showing up as &amp;amp; on the page?▼
That is double encoding: the text was encoded twice, so the `&` of an existing entity became `&` in turn. It usually happens when a template escapes output that was already escaped on the way into the database. Encode once, at the point of output.
Do I still need entities if my page is UTF-8?▼
For accented letters, symbols and emoji, no — with a UTF-8 charset you can write them literally, which is more readable. The five reserved HTML characters still must be encoded, because they are structural markup rather than a character-set issue.
Is encoding entities enough to prevent XSS?▼
Not on its own. Escaping for HTML text content is only correct in that one context. Attribute values, inline JavaScript, CSS and URLs each need their own escaping rules, and content inside a `<script>` block cannot be made safe by HTML escaping at all. Escape according to context and prefer a framework that does it for you.
What is a non-breaking space used for?▼
` ` renders as a space that will not collapse and will not be used as a line-break point. It is the right way to keep "10 kg" or "Chapter 4" from splitting across lines. Do not use runs of them for indentation or layout — that is what CSS margins and padding are for.
Further Reading
Related Tools
More from Developer Tools:
URL Encoder/Decoder
Encode or decode URL strings. Converts special characters to percent-encoding and back. Free online URL encoder/decoder.
Base64 Encoder/Decoder
Encode and decode Base64 strings instantly. Free online Base64 converter tool for text and files. Works entirely in your browser.
Strip HTML Tags
Remove HTML tags from text and extract plain text content. Options to preserve links and line breaks.