HTML Entities
WebEncode or decode HTML entities (&, <, >, ", ') for safe rendering. Prevent XSS and keep templating output clean and correct.
About HTML Entities
HTML entity encoding turns syntactically meaningful characters such as <, >, &, and " into safe forms like <, >, &, and ", so the browser will not parse them as tags or attributes, and keeps symbols like © or € rendering consistently across encodings. This tool converts between named entities, decimal (©), and hexadecimal (©) forms, and lets you choose to encode only the required characters or every non-ASCII character. The conversion runs entirely inside your browser, and your text never leaves the machine. Tip: Bookmark this tool for quick access during your web development work. All processing happens locally in your browser with no installation required.
How to Use
- Open the HTML Entities tool page
- Enter or paste your data into the input area
- View the real-time results and use the copy button to get the output
Use Cases
- XSS escaping — Convert angle brackets and quotes in user input before injecting it into a page.
- Show source code — Encode tags when displaying HTML in a blog so the browser shows them literally.
- Email templates — Turn copyright and currency symbols into entities for consistent rendering across clients.
- Decode scraped text — Restore readable characters from scraped content containing & or '.
- Clean attribute values — Encode double quotes in title or alt text to avoid closing the attribute early.
- JSON embedding — Encode HTML tags in a JSON string field to safely embed it inside a script tag.
- Attribute injection — Convert special characters in dynamic class or data attributes to prevent markup breakage.
FAQ
Named vs numeric entities?
Named entities like © are readable but depend on the HTML spec name table; numeric entities © and © reference Unicode code points directly, offering broader compatibility and safer use in XML.
Is encoding the five special chars enough?
In HTML body text you usually only need & < >, plus the matching quote inside attribute values. If the declared charset is uncertain, encoding all non-ASCII characters is safer.
Does escaping fully stop XSS?
Entity encoding prevents text from being parsed as tags, but JavaScript, URL, and CSS contexts each need their own escaping. HTML entities alone do not cover every injection surface.
Why does decoded look like a space but copies oddly?
is a non-breaking space (U+00A0), a different code point from a normal space (U+0020). They look alike but are treated differently in search and regex.
Can it process a whole HTML block?
Yes, just paste the text. If you instead want to strip HTML into plain text, use a dedicated HTML-to-text tool; this one focuses on character-level entity coding.
Any browser compatibility requirements?
This tool works in all modern browsers (Chrome, Firefox, Edge, Safari). No plugins or extensions required.
Can I use it offline?
After initial load, most features work offline. The core logic runs entirely in your browser with no network dependency.
Comments
Comments are stored locally in your browser. Configure Giscus for cloud-based comments.