HTML Entity Encoder
Understand HTML Entity Encoder
HTML entity encoding replaces characters the browser would read as markup with escape codes, so they display as text instead.
How it works
Encoding rewrites the five characters that can break out of a text node or an attribute — & < > " and ' — as & < > " and '. The ampersand is handled first, because otherwise escaping an already-escaped string would turn < into &lt;. Decoding runs the other way and understands a common set of named entities plus every numeric form, decimal (A) and hexadecimal (A).
When to use it
- Showing code samples on a page so tags render as text rather than being parsed as markup.
- Escaping user-supplied text before inserting it into a template that does not escape for you.
- Reading scraped or emailed HTML that arrived double-encoded and shows &lt; to the reader.
- Placing a value inside a quoted attribute where a stray quote would end the attribute early.
Watch out for
- Escaping these five characters is correct for text nodes and quoted attribute values, and insufficient everywhere else. Inside a script block, inside a style block, in an unquoted attribute, or in an href, the rules are different and entity encoding alone does not stop injection.
- Encode exactly once. Running an already-escaped string through again produces &lt;, which the reader sees as the literal text <.
- The decoder covers the common named entities and all numeric ones; rarer names from the full HTML5 list of roughly 2,000 pass through unchanged.
- ' is XML, not HTML 4. The portable escape for a single quote in HTML is the numeric ', which is what this tool emits.
Not the right tool for: Sanitizing untrusted HTML that has to keep working as HTML. Escaping turns markup into text; keeping the safe tags and removing the dangerous ones needs a sanitizer such as DOMPurify.
Frequently Asked Questions
Why encode HTML entities?
Encoding HTML entities converts characters with special meaning in HTML (<, >, &, ") into safe representations. Without encoding, user-supplied content can inject HTML or JavaScript, causing XSS (cross-site scripting) vulnerabilities.
What is the difference between named and numeric entities?
Named entities use descriptive codes like & for & and < for <. Numeric entities use decimal (&) or hexadecimal (&) Unicode code points. Both render the same character in browsers.
When do I need to HTML-encode quotes?
Always encode double quotes (" → ") when inserting values inside HTML attribute values. Single quotes (' → ') need encoding in single-quoted attributes. Both are critical for preventing HTML injection.
How to Use HTML Entity Encoder
- Paste or type your input in the input area above.
- The tool processes your input automatically or click Run.
- Copy or download the result using the action buttons.
- Use Ctrl+Enter to run quickly from the keyboard.