HTML Entity Encoder

Encode text to HTML entities or decode entities back to text. Handles named, numeric and hex entities. Bulk text support with instant copy to clipboard.

What HTML Entity Encoding Does

Replaces special HTML characters with their entity equivalents to prevent them from being interpreted as HTML. So < becomes &lt;, > becomes &gt;, & becomes &amp;, " becomes &quot;, ' becomes &#39; or &apos;. Essential for displaying HTML/code examples on web pages without the browser rendering them as actual HTML.

Critical for security: any user-submitted content displayed on a page must be entity-encoded to prevent XSS (cross-site scripting) attacks. A user posting '<script>alert(1)</script>' should display as text, not execute. All major frameworks (React, Vue, Angular) auto-encode by default. Manual encoding via this tool when working in raw HTML or testing security.

Common HTML Entities

CharacterEntity
<&lt;
>&gt;
&&amp;
"&quot;
'&#39; or &apos;
non-breaking space&nbsp;
Β©&copy;
Β£&pound;
€&euro;
βœ“&check; or &#10003;

Frequently Asked Questions

Why use entities instead of UTF-8?

Both work in modern browsers. Entities are explicit (always render correctly even with encoding mishaps). UTF-8 is more compact and natural to read in source. For < > & specifically, you MUST entity-encode in HTML even with UTF-8 - those characters have HTML structural meaning.

Should I encode user input on display?

Yes - always. Modern frameworks auto-encode. For raw HTML/template work, run user content through entity encoding before inserting. Failure to encode is the #1 cause of XSS vulnerabilities. The OWASP Top 10 has covered XSS for years for this reason.

More tools β†’