HTML Encoder
Encode and decode HTML entities
Online HTML Entity Encoder - Escape and Encode
What are HTML entities and why do you need them?
HTML entities are special codes that represent characters you cannot write directly in HTML, or characters that carry syntactic meaning in the language. The characters < > & " and the apostrophe MUST be encoded when they appear as content rather than markup, otherwise the browser reads them as HTML and either breaks the page or, worse, opens the door to XSS attacks. Beyond those, non-ASCII characters such as accented letters, mathematical symbols, emoji and characters from other writing systems can be encoded to guarantee compatibility with every character encoding and legacy system.
What is the difference between named and numeric entities?
Named entities are mnemonic and readable: & for the ampersand, < for less than, > for greater than, " for a double quote, ' for a single quote, for a non-breaking space and © for the copyright sign. They only exist for a subset of common characters, though. Numeric entities can represent any Unicode character, in decimal form such as < (which is <) or hexadecimal form such as < (also <). Both formats are functionally equivalent and valid in HTML5, and numeric ones are the only option for rare characters and emoji that have no assigned name.
How does HTML encoding prevent XSS attacks?
Cross-Site Scripting (XSS) happens when malicious user data is inserted into HTML without escaping, allowing unauthorised JavaScript to execute. If a user submits <script>stealCookies()</script> as their name and the value is rendered unencoded, the script runs. HTML encoding turns that into <script>stealCookies()</script>, which is displayed as harmless text instead. Modern frameworks such as React, Angular and Vue encode automatically, but you must be extremely careful with innerHTML, dangerouslySetInnerHTML, [innerHTML] and similar APIs that bypass the protection.
If you work with this tool, you will probably also find these useful Text Escaper, HTML Beautifier, Base64 Encoder, URL Encoder.
Frequently asked questions
When should I encode characters as HTML entities?
Whenever you render dynamic or user-supplied content in HTML. That covers user comments, names and profiles, form data, content from external APIs, search results, error messages that echo user input, and any string you do not fully control. The security rule is to encode all output for the context it lands in. Modern frameworks handle the HTML context automatically, but not URLs, inline JavaScript or CSS, each of which needs its own encoding.
What is the difference between HTML encoding and URL encoding?
They are completely different systems for different contexts. HTML encoding uses & followed by an entity name or number (& for &) and applies inside HTML documents. URL encoding uses % followed by two hexadecimal digits (%26 for &) and applies to characters that are not allowed in URIs. Using the wrong one for the context causes bugs or, worse, security holes: an ampersand in a URL is encoded as %26, while in HTML it becomes &.
Should I encode spaces and line breaks in HTML?
Ordinary spaces need no encoding, but HTML collapses runs of consecutive spaces into one. To preserve them, use (a non-breaking space) or the CSS white-space: pre-wrap. Line breaks in the HTML source are ignored during rendering, so use <br> for a visible break or CSS white-space to preserve the formatting. Only characters with syntactic meaning in HTML and characters outside the basic ASCII range strictly require encoding.