HTML Entity Encoder/Decoder
Convert between text and HTML entities. Encode special characters or decode entities back to readable text.
Input
Output
HTML Entity Reference
| Character | Named Entity | Numeric Entity | Description | Actions |
|---|---|---|---|---|
| " | " | " | Quotation mark | |
| ' | ' | ' | Apostrophe | |
| & | & | & | Ampersand | |
| < | < | < | Less than | |
| > | > | > | Greater than | |
| |   | Non-breaking space | ||
| ¡ | ¡ | ¡ | Inverted exclamation | |
| ¢ | ¢ | ¢ | Cent sign | |
| £ | £ | £ | Pound sign | |
| ¤ | ¤ | ¤ | Currency sign | |
| ¥ | ¥ | ¥ | Yen sign | |
| ¦ | ¦ | ¦ | Broken bar | |
| § | § | § | Section sign | |
| ¨ | ¨ | ¨ | Diaeresis | |
| © | © | © | Copyright | |
| ª | ª | ª | Feminine ordinal | |
| « | « | « | Left angle quote | |
| ¬ | ¬ | ¬ | Not sign | |
| | ­ | ­ | Soft hyphen | |
| ® | ® | ® | Registered trademark | |
| ¯ | ¯ | ¯ | Macron | |
| ° | ° | ° | Degree sign | |
| ± | ± | ± | Plus-minus | |
| ² | ² | ² | Superscript two | |
| ³ | ³ | ³ | Superscript three | |
| ´ | ´ | ´ | Acute accent | |
| µ | µ | µ | Micro sign | |
| ¶ | ¶ | ¶ | Paragraph sign | |
| · | · | · | Middle dot | |
| ¸ | ¸ | ¸ | Cedilla | |
| ¹ | ¹ | ¹ | Superscript one | |
| º | º | º | Masculine ordinal | |
| » | » | » | Right angle quote | |
| ¼ | ¼ | ¼ | One quarter | |
| ½ | ½ | ½ | One half | |
| ¾ | ¾ | ¾ | Three quarters | |
| ¿ | ¿ | ¿ | Inverted question | |
| × | × | × | Multiplication | |
| ÷ | ÷ | ÷ | Division | |
| € | € | € | Euro sign | |
| ™ | ™ | ™ | Trademark | |
| ← | ← | ← | Left arrow | |
| ↑ | ↑ | ↑ | Up arrow | |
| → | → | → | Right arrow | |
| ↓ | ↓ | ↓ | Down arrow | |
| ↔ | ↔ | ↔ | Left-right arrow | |
| ∀ | ∀ | ∀ | For all | |
| ∂ | ∂ | ∂ | Partial differential | |
| ∃ | ∃ | ∃ | There exists | |
| ∅ | ∅ | ∅ | Empty set | |
| ∇ | ∇ | ∇ | Nabla | |
| ∈ | ∈ | ∈ | Element of | |
| ∉ | ∉ | ∉ | Not element of | |
| ∋ | ∋ | ∋ | Contains | |
| ∏ | ∏ | ∏ | Product | |
| ∑ | ∑ | ∑ | Sum |
Usage Tips
- Standard Encoding: Encodes only essential HTML characters (&, <, >, ", ')
- All Characters: Converts every character to numeric entities (useful for email obfuscation)
- Non-ASCII Only: Encodes characters outside the ASCII range (0-127)
- Decoding: Supports both named entities (©) and numeric entities (© or ©)
What is HTML Entity Encoding?
HTML entity encoding is the process of converting special characters into their safe escape sequences so browsers interpret them as text rather than HTML code. For example, the less-than symbol (<) becomes <, the ampersand (&) becomes &, and the quotation mark (") becomes ". When you have user-generated content or any untrusted text that needs to be displayed in an HTML page, encoding these characters prevents them from being interpreted as HTML markup. This is critical for preventing cross-site scripting (XSS) attacks where malicious code could be injected through unencoded input. HTML entity encoding is not encryption—it doesn't make content unreadable—but rather a representation that ensures special characters are displayed safely in HTML contexts.
There are two types of HTML entities: named entities (like &, <, ) and numeric entities (like <, < for hexadecimal). Both serve the same purpose but named entities are more readable while numeric entities are more universally supported. This tool supports both encoding and decoding, with options to encode only essential HTML characters (safer for content) or all special characters (better for obfuscation).
Common Use Cases
- XSS Prevention: Encode user input before displaying it in HTML to prevent attackers from injecting malicious scripts through special characters.
- HTML Attribute Encoding: Safely include special characters in HTML attributes like onclick, data-*, title, and alt text.
- Email Template Generation: Encode special characters in HTML emails to ensure they display correctly across different email clients and prevent script injection.
- API Response Rendering: Encode API response data before inserting it into the DOM to prevent XSS vulnerabilities from untrusted sources.
- Code Documentation: Encode code snippets in HTML documentation so <, >, and & characters display as text rather than being interpreted as tags.
How to Use This Tool
- Select Mode: Choose between Encode (convert text to entities) or Decode (convert entities back to text) using the Mode toggle.
- Choose Encoding Level (Encode mode only): Select Standard (Essential Only) for &, <, >, ", ' only; All Characters to encode every special character; or Non-ASCII Only to encode characters outside ASCII range.
- Enter Your Content: Paste text into the input panel on the left side.
- View Result: The encoded or decoded result appears instantly in the output panel with statistics showing character count.
- Copy Output: Click Copy to copy the result to your clipboard, or reference the Entity Table to find specific entities.
Features
Standard (Essential Only)
Encodes only the 5 essential HTML characters: & < > " and '. This is the safest default for most content and minimizes output size.
All Characters
Encodes every special character to numeric entities. Useful for maximum email obfuscation or when targeting legacy browsers with limited entity support.
Named vs Numeric Entities
Named entities (©) are human-readable but less universally supported. Numeric entities (© or ©) work everywhere and are often used in email clients.
Non-ASCII Only
Encodes only characters outside the ASCII range (0-127). Useful for HTML documents with mixed character sets where ASCII characters should remain readable.
Frequently Asked Questions
What is the difference between HTML encoding and URL encoding?
HTML encoding converts text for safe display in HTML pages using entities like < and &. URL encoding converts text for safe transmission in URLs using percent-encoding like %3C and %26. Use HTML encoding for page content and URL encoding for query parameters.
Do I need to encode inside JavaScript strings?
HTML encoding is for HTML content only. JavaScript strings use their own escaping rules (backslash escapes like \" and \'). Only HTML-encode strings when inserting them into the DOM via innerHTML or other HTML contexts.
What is XSS and how does encoding prevent it?
XSS (Cross-Site Scripting) is an attack where malicious scripts are injected into web pages through unencoded user input. Encoding special characters prevents < and > from being interpreted as HTML tags, stopping script injection. Always encode untrusted user input before displaying it.
What characters must always be HTML-encoded?
The five essential characters are: & (ampersand), < (less-than), > (greater-than), " (double-quote), and ' (single-quote). These have special meaning in HTML and must always be encoded when used as text. Encoding these prevents XSS and ensures correct rendering.