How to use HTML Entity Encoder
- Choose Encode or Decode and paste your text.
- When encoding, pick what to escape (just HTML special characters, all non-ASCII characters, or everything) and whether to use named, decimal or hex entities.
- Copy the result, or click any entity in the reference grid to copy its code.
About this tool
Some characters have a special meaning in HTML. A < starts a tag and an & starts an entity, so to show them as text they must be written as < and &. Escaping user input this way is also the first defence against cross-site scripting (XSS).
Entities come in three styles: named (©), decimal (©) and hex (©). All three produce the same character. Encoding non-ASCII characters is useful when a file or email system cannot handle UTF-8, and numeric entities work for every Unicode character including emoji.
The decoder understands every named entity defined in HTML5 because it uses your browser's own HTML parser. Text is decoded safely: no markup is ever run.
Questions and answers
Which characters must be escaped in HTML?
Inside text, escape < and &. Inside attribute values, also escape the quote character you used (" or '). Escaping > as well is common practice and does no harm.
Should I use named or numeric entities?
Named entities are easier to read. Numeric entities work for every character, including emoji and symbols that have no name. Both are understood by all browsers.
Is HTML encoding the same as URL encoding?
No. URL encoding uses percent signs (%20 for a space) and is for URLs. HTML entities use & and ; and are for HTML documents.
Does this protect against XSS?
Escaping < > & " and ' before inserting text into HTML prevents most XSS, but each context (attributes, JavaScript, URLs, CSS) has its own rules. Use your framework's built-in escaping in real applications.