HTML Entity Encoder & Decoder
Safely escape HTML characters to prevent XSS attacks, or decode raw entities back into readable text. Instantly process named, decimal, and hexadecimal entities.
Entity Reference Guide
| Char | Named | Decimal | Hexadecimal | Description |
|---|
What is HTML Entity Encoding?
In HTML, certain characters are reserved for the language's syntax. For example, the less-than sign (<) and greater-than sign (>) are used to create tags. If you want to display these characters as text on a web page without the browser trying to interpret them as code, you must convert them into HTML Entities.
An HTML entity is a string of text that begins with an ampersand (&) and ends with a semicolon (;). The most common entities are named (like & for &), but characters can also be represented by their decimal or hexadecimal unicode numbers.
How to use the Entity Converter
- Select Mode: Choose "Encode" to convert raw text/code into safe HTML entities. Choose "Decode" to convert entities back into readable text.
- Input Text: Paste your payload into the input box. The conversion happens instantaneously as you type.
- Choose Format (Encoding): When encoding, you can force the output to use Named, Decimal, or Hex formats. If Named is selected but a character has no standard name, it defaults to the raw character or decimal format.
- Copy Output: Use the "Copy Output" button to grab the safe string for your application.
Features of this Tool
- ✓ 100% client-side — your strings are parsed offline ensuring absolute data privacy.
- ✓ Live Bidirectional Sync: Switch between encode and decode modes instantly without losing data.
- ✓ Multi-Format Support: Handles traditional named entities (
©) alongside standard Unicode decimal (©) and hex (©) codes. - ✓ Security Focused: Crucial tool for escaping user input to prevent Cross-Site Scripting (XSS) injection attacks before saving to a database.
- ✓ Interactive Cheat Sheet: Includes a searchable reference table of the 50 most common HTML entities. Click any code in the table to instantly copy it.
Frequently Asked Questions
Why is HTML encoding important for security?
If you build an application that accepts user input (like a comment section) and you render that input on the page without encoding it, an attacker can input <script>maliciousCode()</script>. The browser will execute that script. By encoding the input, the string becomes <script>maliciousCode()</script>, which the browser renders safely as plain text instead of executing it.
What's the difference between URL Encoding and HTML Encoding?
They serve different purposes in web development. URL Encoding (percent-encoding, like %20 for a space) ensures that data passed through a web address is transmitted correctly over HTTP. HTML Encoding ensures that data rendered inside an HTML document is displayed as text rather than parsed as DOM elements.
Should I use Named, Decimal, or Hex entities?
Named entities are easier for humans to read while coding (e.g., €). However, not all unicode characters have a named entity. Decimal and Hexadecimal entities cover the entire Unicode spectrum, making them universally compatible across all modern browsers for rendering special symbols and foreign characters.