HTML Entity Encoder / Decoder

What are HTML entities and when do you need them?

HTML gives special meaning to a handful of characters: < starts a tag, & starts an entity, and quotes delimit attribute values. To display these characters literally — showing code samples on a page, embedding user text in an attribute — you replace them with entities: <, &, ", '. The encode tab here escapes exactly those five critical characters, the same set every templating engine escapes by default. This is also the core defence against reflected XSS: attacker-controlled text that has been entity-encoded can no longer break out of its context and become markup.

Named vs numeric entities — and why decoding is the messy direction

The same character often has three spellings: é (named), é (decimal) and é (hexadecimal) all mean é. HTML5 defines over two thousand named entities — far too many to hand-maintain a lookup table — so this tool's decoder delegates to your browser's own HTML parser, which resolves every named, decimal and hex reference exactly as a real page render would. Emoji and other characters outside the Basic Multilingual Plane work too: 😀 decodes to 😀 as a proper surrogate pair. On the encode side, the "non-ASCII" option converts every character above U+007F to a decimal reference — useful when a legacy system mangles UTF-8 and you need output that survives any 7-bit pipeline.

FAQ

Entity encoding vs URL encoding — which one do I want?

They solve different problems. Entity encoding (&) protects text placed inside HTML. URL / percent encoding (%26) protects text placed inside a URL. A link with a query string inside an HTML page needs both, applied in layers: percent-encode the parameter values, then entity-encode the resulting URL when writing it into the href attribute.

Why does the encoder use ' instead of '?

' comes from XML and was only added to HTML in HTML5 — old HTML4 parsers and some email clients don't recognise it. The numeric form ' is understood everywhere, so it's the safer choice.

Is encoding enough to prevent all XSS?

It neutralises text inserted into an HTML body or quoted attribute — the most common case. But different contexts need different escaping: inline JavaScript, CSS and URLs each have their own rules, and no single encoding covers them all. Use a templating engine's context-aware escaping in production; use this tool for inspecting and crafting the encoded text itself.