HTML Entity Encoder & Decoder
Encode and decode HTML special characters and entities. Converts to named (©), decimal (©).
Source Text
Encoded HTML Entities
⚖️ Decision Verdict: XSS-Safe HTML String
All HTML reserved delimiters (<, >, &, ") have been safely escaped into standard named entities, preventing DOM Cross-Site Scripting (XSS).
Character Encoding Telemetry
Essential HTML Entities Reference Cheatsheet
| Char | Description | Named Entity | Decimal | Hexadecimal |
|---|---|---|---|---|
< | Less Than (Tag Open) | < | < | < |
> | Greater Than (Tag Close) | > | > | > |
& | Ampersand | & | & | & |
" | Double Quotation | " | " | " |
' | Single Apostrophe | ' | ' | ' |
© | Copyright Symbol | © | © | © |
€ | Euro Sign | € | € | € |
£ | Pound Sterling | £ | £ | £ |
About this tool
How to use it
- Select your operation: Encode text to HTML entities, or Decode entities back to plain text.
- For encoding, choose your entity format: Named (©), Decimal (©), or Hexadecimal (©).
- Type or paste your text or HTML code snippet into the source editor.
- View instant converted output with live character, byte, and entity count telemetry.
- Click 'Copy Output' to paste sanitized code directly into your markup or database.
Why it matters
In web development and content management systems (WordPress, Drupal, headless CMS), characters like <, >, &, and quotes have syntactical meaning in HTML. If rendered unescaped in user-generated content, they trigger browser rendering errors or lethal Cross-Site Scripting (XSS) injection attacks. Escaping them into entities guarantees safe, cross-browser rendering.
When to use it
Use this tool when displaying raw code blocks in markdown/HTML, sanitizing database outputs, fixing broken character encoding artifacts, or bypassing email client parsing bugs.
Good to know
Security Notice: HTML entity encoding is the primary defense against Stored and Reflected XSS when injecting untrusted strings into HTML body contexts.
Common questions
What is an HTML entity?
An HTML entity is a piece of text (starting with an ampersand '&' and ending with a semicolon ';') used to display reserved HTML characters (like '<' and '>') or invisible/special characters (like non-breaking spaces ' ' and copyright '©') that cannot be directly typed.
What are the five essential XML/HTML predefined entities?
The five core XML/HTML entities are: `"` for double quote ("), `&` for ampersand (&), `'` (or `'`) for single quote ('), `<` for less-than (<), and `>` for greater-than (>).
What is the difference between named and numeric entities?
Named entities use human-memorable text aliases (e.g. `©`), but are only recognized in HTML documents. Numeric entities reference the character's exact Unicode code point in decimal (`©`) or hexadecimal (`©`), and are universally supported in both HTML and XML.
Does HTML entity encoding protect against XSS?
Encoding `<` and `>` into `<` and `>` neutralizes malicious `<script>` tags by forcing the web browser to treat them as harmless text strings rather than executable DOM instructions.
Why do some entities appear as strange symbols on my page?
When a page lacks a `<meta charset='utf-8'>` declaration or undergoes multiple incorrect encode/decode cycles (known as 'mojibake'), characters like '©' can turn into garbled strings like '©'. Using numeric HTML entities avoids encoding mismatch issues.