How it works
The HTML Entities Encoder converts special characters in text to their HTML entity equivalents — and decodes HTML entities back to readable characters. The < character becomes <, > becomes >, & becomes &, and " becomes ".
HTML entity encoding is essential for web security and correct rendering. Anytime user-supplied text is inserted into HTML, the characters <, >, &, and " must be encoded to prevent the browser from interpreting them as HTML markup. Failure to do so is the #1 cause of Cross-Site Scripting (XSS) vulnerabilities.
How to use it: paste your text containing special characters and click Encode to get the safe HTML-entity version. Paste HTML with entity codes and click Decode to get the readable text. The tool handles the full named entity set (e.g., © → ©, → non-breaking space) as well as numeric entities (&#60; for <).
Security use case: if you're building a web app and need to display user-submitted content, always pass it through HTML encoding before inserting it into the DOM. This prevents a string like <script>alert('xss')</script> from executing as JavaScript.
Editor use case: when writing HTML tutorials, documentation, or blog posts about code, you need to show code examples as text without the browser interpreting them. Encoding angle brackets ensures your < and > appear as literal characters.
Frequently Asked Questions
- The essential HTML special characters: < becomes <, > becomes >, & becomes &, " becomes ", and ' becomes '. Optionally, all non-ASCII characters can be encoded as numeric entities (e.g., © as &#169;).
- Inserting unescaped user input into HTML is the root cause of Cross-Site Scripting (XSS) — one of the most common web vulnerabilities. Encoding < and > prevents user input from being interpreted as HTML tags.
- Yes. Toggle to Decode mode and paste HTML containing entity codes. Both named entities (&lt;, &copy;) and numeric entities (&#60;, &#169;) are decoded to their Unicode characters.
- They describe the same operation in different contexts. 'HTML encoding' converts characters to entity references for safe HTML rendering. 'Escaping' is the more general term for making special characters literal. In HTML, they are synonymous.