HTML Entities
WebEncode or decode HTML entities (&, <, >, ", ') for safe rendering, preventing XSS and keeping templating output clean and predictable.
Related Tools
About HTML Entities
HTML entity encoding turns syntactically meaningful characters such as <, >, &, and " into safe forms like <, >, &, and ", so the browser will not parse them as tags or attributes, and keeps symbols like © or € rendering consistently across encodings. This tool converts between named entities, decimal (©), and hexadecimal (©) forms, and lets you choose to encode only the required characters or every non-ASCII character.
How to Use
- Open the HTML Entities tool
- Enter or paste the content to process
- Adjust the output options as needed
- Click the Run button; results appear in real time
- Copy or export the result
Use Cases
- XSS escaping — Convert angle brackets and quotes in user input before injecting it into a page.
- Show source code — Encode tags when displaying HTML in a blog so the browser shows them literally.
- Email templates — Turn copyright and currency symbols into entities for consistent rendering across clients.
- Decode scraped text — Restore readable characters from scraped content containing & or '.
- Clean attribute values — Encode double quotes in title or alt text to avoid closing the attribute early.
- JSON embedding — Encode HTML tags in a JSON string field to safely embed it inside a script tag.
- Attribute injection — Convert special characters in dynamic class or data attributes to prevent markup breakage.
FAQ
Named vs numeric entities?
Named entities like © are readable but depend on the HTML spec name table; numeric entities © and © reference Unicode code points directly, offering broader compatibility and safer use in XML.
Is encoding the five special chars enough?
In HTML body text you usually only need & < >, plus the matching quote inside attribute values. If the declared charset is uncertain, encoding all non-ASCII characters is safer.
Does escaping fully stop XSS?
Entity encoding prevents text from being parsed as tags, but JavaScript, URL, and CSS contexts each need their own escaping. HTML entities alone do not cover every injection surface.
Why does decoded look like a space but copies oddly?
is a non-breaking space (U+00A0), a different code point from a normal space (U+0020). They look alike but are treated differently in search and regex.
Can it process a whole HTML block?
Yes, just paste the text. If you instead want to strip HTML into plain text, use a dedicated HTML-to-text tool; this one focuses on character-level entity coding.
Why does & in my page display as just &?
Because the browser decodes entities when parsing HTML, so & is rendered as the literal & character — that is correct, expected behavior. Trouble arises when escaping goes wrong: if you double-encode an already-encoded string you get &amp; and the page literally shows &; if you leave a raw & un-encoded, some parsers mistake it for the start of a malformed entity and drop the rest of the sequence. Encode exactly once per output and keep the source text un-encoded in storage.
Entities vs escaping — are these the same thing?
Escaping is the act of replacing a reserved character with an entity so it is treated as literal text; an entity such as < is the encoded form that results. The two terms usually describe the same encode/decode cycle. Context matters: frameworks like Vue/React auto-escape by default, and setting text via textContent is safe, whereas manually building innerHTML requires you to escape every dynamic value. Only encode once per output layer to avoid &amp; double-encoding.