Encoders

HTML Entity Encoder/Decoder

Encode and decode HTML entities for web development

Encode all chars

Preserve whitespace

Text to Encode

Common HTML Entities

About

Encodes and decodes HTML entities with named, numeric, and hex reference modes. Provides body and attribute content presets that follow HTML spec escaping rules, a searchable entity reference table, and quick-insert buttons for common entities like & < > " '.

Handling HTML entities manually leads to XSS vulnerabilities and rendering bugs when user-generated content contains special characters. This tool ensures proper encoding based on context (body vs attribute) and makes it easy to look up or insert any HTML entity.

Who should use this tool?

Frontend developers sanitizing user input, content authors preparing HTML with special characters, and security engineers auditing XSS prevention in templates.

Common use cases

Encode user-submitted content before rendering in HTML to prevent XSS attacks
Decode HTML entity strings from an API response back to readable text
Use body preset for content inside <div> tags and attribute preset for values in href="..."
Look up the entity reference for a specific Unicode character like a copyright symbol
Use quick-insert buttons to add common entities while editing HTML content

How to Use

Type or paste text in the input area; the encoded/decoded output updates in real time

Select encoding mode: named (&), numeric (&), or hex (&) reference style

Choose a preset: Body (encodes < > &) or Attribute (encodes < > & " ') for context-appropriate escaping

Use the entity reference table to search for any Unicode character by name, code point, or entity

Click quick-insert buttons to instantly insert common entities like © or —

Use the decode mode to convert entity-encoded text back to plain characters

Examples

Input: '<script>alert(1)</script>' with body preset. Output: '&lt;script&gt;alert(1)&lt;/script&gt;'

Input: '© 2024 My Company' with hex mode encode. Output: '&#xa9; 2024 My Company'

Best Practices

Always use the attribute preset when encoding values that will appear in HTML attributes to escape quotes
Use named entities for readability in hand-coded HTML; use numeric for broader compatibility
Never double-encode content; if content was already entity-encoded, use decode first
Bookmark the entity reference table for quick lookup of obscure Unicode entities

Common Mistakes

Using body encoding for attribute values, leaving quotes unescaped and vulnerable to injection
Encoding an already-encoded string, resulting in double-encoded output like &lt;
Using a preset that does not match the target context, such as attribute for a text node
Assuming all browsers handle hex entities identically; numeric is safer for legacy support

FAQ

What is the difference between named, numeric, and hex entities? Named use & etc, numeric use &, hex use &. All render the same character.

Why does the attribute preset also escape quotes? Quotes delimit attribute values and must be escaped to prevent breaking the HTML.

Can I decode HTML entities from an RSS feed? Yes, paste the feed content and switch to decode mode.

Is the entity reference table searchable? Yes, type a character name, entity name, or code point to filter.

Related Tools

Same Category — Encoders

Base64 Encoder/Decoder

Encode and decode Base64 strings online free

URL Encoder/Decoder

Encode and decode URLs and URL components online free

Base64 Image Converter

Convert images to Base64 encoded strings for embedding in HTML/CSS

String Escape/Unescape

Escape and unescape strings for JavaScript, JSON, HTML, URL, and more

Popular Tools

JSON Formatter

Format, validate, and minify JSON data with syntax highlighting

JWT Decoder

Decode and analyze JWT tokens online free

SQL Formatter

Format and beautify SQL queries with syntax validation

Learning Resources

Dive deeper with our comprehensive guides and tutorials.

HTML Entity Encoder/Decoder - Beginner's Guide

5 min read

HTML Entity Encoder/Decoder Advanced Techniques

8 min read

About

Who should use this tool?

Frontend developers sanitizing user input, content authors preparing HTML with special characters, and security engineers auditing XSS prevention in templates.

Common use cases

Encode user-submitted content before rendering in HTML to prevent XSS attacks
Decode HTML entity strings from an API response back to readable text
Use body preset for content inside <div> tags and attribute preset for values in href="..."
Look up the entity reference for a specific Unicode character like a copyright symbol
Use quick-insert buttons to add common entities while editing HTML content

How to Use

Type or paste text in the input area; the encoded/decoded output updates in real time

Select encoding mode: named (&), numeric (&), or hex (&) reference style

Choose a preset: Body (encodes < > &) or Attribute (encodes < > & " ') for context-appropriate escaping

Use the entity reference table to search for any Unicode character by name, code point, or entity

Use the decode mode to convert entity-encoded text back to plain characters

Best Practices

Always use the attribute preset when encoding values that will appear in HTML attributes to escape quotes

Use named entities for readability in hand-coded HTML; use numeric for broader compatibility

Never double-encode content; if content was already entity-encoded, use decode first

Bookmark the entity reference table for quick lookup of obscure Unicode entities

Common Mistakes

Using body encoding for attribute values, leaving quotes unescaped and vulnerable to injection

Encoding an already-encoded string, resulting in double-encoded output like &lt;

Using a preset that does not match the target context, such as attribute for a text node

Assuming all browsers handle hex entities identically; numeric is safer for legacy support

FAQ

What is the difference between named, numeric, and hex entities? Named use & etc, numeric use &, hex use &. All render the same character.

Why does the attribute preset also escape quotes? Quotes delimit attribute values and must be escaped to prevent breaking the HTML.

Can I decode HTML entities from an RSS feed? Yes, paste the feed content and switch to decode mode.

Is the entity reference table searchable? Yes, type a character name, entity name, or code point to filter.

HTML Entity Encoder/Decoder

About

Who should use this tool?

Common use cases

How to Use

Examples

Best Practices

Common Mistakes

FAQ

Related Tools

Same Category — Encoders

Base64 Encoder/Decoder

URL Encoder/Decoder

Base64 Image Converter

String Escape/Unescape

Popular Tools

JSON Formatter

JWT Decoder

SQL Formatter

Learning Resources

Share

HTML Entity Encoder/Decoder

About

Who should use this tool?

Common use cases

How to Use

Examples

Best Practices

Common Mistakes

FAQ

Related Tools

Same Category — Encoders

Base64 Encoder/Decoder

URL Encoder/Decoder

Base64 Image Converter

String Escape/Unescape

Popular Tools

JSON Formatter

JWT Decoder

SQL Formatter

Learning Resources

Share