Why do I need to encode HTML?

Encoding HTML prevents special characters from being interpreted as HTML tags, protecting against XSS attacks and ensuring correct display.

What are the most common HTML entities?

< for , & for &, " for ", ' for '. These five cover most encoding needs.

What is the difference between named and numeric HTML entities?

A named entity like & is human-readable, while a numeric reference encodes the same character by its Unicode code point in decimal (&) or hexadecimal (&). Numeric references always work; named entities depend on the parser recognising the name.

Which characters must I escape in HTML?

In ordinary text content escape & as &, as >. Inside an attribute value you must also escape whichever quote delimits it: the double quote as " or the apostrophe as '.

Does HTML encoding by itself prevent XSS?

It helps in HTML body and attribute contexts, but it is not a universal fix. Data placed inside script blocks, inline event handlers, URLs or CSS needs context-specific escaping. Always encode for the exact context where the value is inserted.

How do I show a literal less-than sign on a page?

Write < in your markup and the browser renders it as a literal character without starting a tag. Likewise use > for the greater-than sign and & for an ampersand so the characters display instead of being parsed as markup.

Why does an ampersand sometimes break my HTML?

A raw & starts a character reference, so the parser may try to interpret the following text as an entity. Encoding it as & tells the browser you mean a literal ampersand, which is essential in URLs containing multiple query parameters.

HTML Encoder / Decoder — Escape HTML Entities

Character	Entity
&	&
<	<
>	>
"	"
'	'
©	©
®	®
™	™
(non-breaking space)
—	—

How to use HTML Encoder / Decoder

The HTML Encoder / Decoder converts special characters to HTML entities and back again. Characters such as <, >, &, " and ' have reserved meaning in HTML markup and must be replaced with their entity equivalents (<, >, &, ", ') before being inserted into HTML documents. This prevents cross-site scripting (XSS) vulnerabilities and ensures that user-generated content displays correctly in browsers.

Paste the text you want to encode or decode into the input field.
Click Encode to replace HTML special characters with safe entity references.
Click Decode to convert HTML entities back to their original characters.
Optionally enable "Encode all non-ASCII" to also convert accented and Unicode characters to numeric entities (&#NNNN;).
Copy the safe output ready for insertion into your HTML template or source code.

Your data never leaves your device — 100% private processing.

Named vs numeric HTML entities

HTML entities come in two forms: named entities such as & and ©, and numeric entities in decimal (©) or hexadecimal (©) form. Named entities are defined by the HTML specification and cover common typographic and international characters. Numeric entities can represent any Unicode code point, making them universally applicable even when no named entity exists. All modern browsers support both forms.

Essential HTML entities
Character	Named entity	Decimal entity	Use case
<	<	<	Tag-like text in content
>	>	>	Closing angle brackets
&	&	&	Literal ampersand
"	"	"	Quotes inside attribute values
'	'	'	Single quotes in attributes
©	©	©	Copyright symbol
—	—	—	Em dash in typography

HTML encoding and XSS prevention

Cross-site scripting (XSS) occurs when an attacker injects script tags or event handlers into a page by supplying input that contains HTML syntax. If user-supplied text is rendered into a page without encoding, a string like <script>alert(1)</script> executes as JavaScript. Encoding transforms < to < and > to >, making the injected markup display as inert text. Server-side templating engines (Jinja2, Blade, Thymeleaf) HTML-encode by default; raw output functions such as {{ raw }} bypass this protection and should be used with great caution.

Worked examples

Encode HTML special characters

Inputs: '<div>'

Result: <div>

Encode an ampersand

Inputs: 'Tom & Jerry'

Result: Tom & Jerry

Decode entities back to text

Inputs: '"hi"'

Result: "hi"

Glossary

HTML entity: A text sequence starting with & and ending with ; that represents a special character in HTML.
XSS: Cross-Site Scripting — an attack that injects malicious scripts into web pages by exploiting unencoded output.
Named entity: An HTML entity identified by a human-readable name, such as & for the ampersand character.
Numeric entity: An HTML entity identified by its Unicode code point in decimal (&#N;) or hex (&#xN;) form.
Sanitization: Removing or neutralising dangerous HTML constructs (scripts, event handlers) from untrusted input.

Related Developer Tools

URL Encoder / Decoder

Encode and decode URLs and URL components online. Convert special characters to percent-encoding and back instantly — free, private, and fast.

Base64 Encoder & Decoder

Encode text or files to Base64, or decode Base64 strings back to text in seconds. Free, private, and fully in-browser now.

JSON Formatter & Validator

Format, validate, and minify JSON instantly. Includes syntax highlighting, error detection, and a collapsible tree view — free, private, in-browser.

Unicode Escape / Unescape

Escape text to Unicode sequences (\uXXXX, HTML &#x; entities, CSS \HH) or unescape them back to readable characters. Free, instant, in your browser.

String Escape / Unescape

Escape or unescape strings for JavaScript, Java, C/C++, JSON, SQL, CSV and shell. Safely embed quotes and special characters, processed in your browser.

Regex Tester

Test and debug regular expressions online. See live matches, capture groups, and replace output. Free, private, instant.

Explore all Developer Tools.

HTML Encoder / Decoder

How to use HTML Encoder / Decoder

Named vs numeric HTML entities

HTML encoding and XSS prevention

Worked examples

Glossary

Related reading

Frequently Asked Questions

Why use HTML Encoder / Decoder?

Common use cases

Get weekly tool tips & updates

Related Developer Tools