HTML Entity Encoder

About the HTML Entity Encoder & Decoder

This free online tool encodes and decodes HTML entities so that special characters display correctly in web pages and so that user input is safely embedded without triggering cross-site scripting (XSS). It supports named entities (&, ©), decimal numeric references (&), and hex references (&).

Why Entities Matter

Browsers interpret characters like <, >, &, and quotes as HTML syntax. If untrusted user input contains these characters and is inserted into a page without encoding, an attacker can inject tags or script. Encoding converts them to safe entities that render as the original character but are not parsed as markup — the simplest and most effective XSS defense in HTML contexts.

Encoding Modes

• Named — human-readable (©, €), great for documentation
• Decimal numeric — &; universal and works for every Unicode code point
• Hex numeric — &; shorter for high code points like emoji
• Minimal — only the five XML-reserved characters, which is what most templating engines do by default

Common Use Cases

• Display sample code in HTML without the browser parsing it
• Sanitize user-generated content for safe insertion in a page
• Debug XSS findings and verify entity-based payloads
• Prepare copy for RSS feeds, Atom entries, and email templates
• Encode non-ASCII characters for older systems that force ASCII output

Frequently Asked Questions

Is HTML entity encoding enough to prevent XSS?

For HTML text content and most attribute values, yes — provided you encode the right set of characters for the context. Inside<script>, URL attributes, and inline CSS, entity encoding alone is not enough; use context-specific escaping or a safe templating library instead.

Which entities does the encoder know by name?

A curated set of ~50 commonly-used entities (currency, punctuation, arrows, math) plus the five XML-reserved characters. For anything else, switch to numeric or hex mode and every Unicode code point is encoded correctly.

Is my text sent anywhere?

No. Encoding and decoding happen in your browser — safe for user-generated content, secrets, and private documents.

Related Guides

Deep-dive on safe HTML output in HTML entities and XSS, or encode URLs with the URL Encoder.