HTML Entity Encoder & Decoder

Encode reserved HTML characters for safe display or decode entity strings from CMS exports—instantly, with no server upload.

By Muhammad Abdullah Rauf · Founder, EverydayTools.proUpdated 2026-05-21

What is an HTML entity encoder?

An HTML entity encoder converts characters with special meaning in HTML (&, <, >, quotes) into entity references like &amp; and &lt; so they render as text instead of markup—essential for XSS prevention.

HTML reserves certain characters for document structure. The ampersand (&) starts every entity; angle brackets (<, >) delimit tags; double and single quotes delimit attributes. When user-supplied or dynamic text is inserted into HTML without encoding, a string like <script>alert(1)</script> becomes executable markup—a cross-site scripting (XSS) vulnerability.

Entity encoding replaces each dangerous character with an escape sequence: & → &amp;, < → &lt;, > → &gt;, " → &quot;, ' → &#39; (or &apos;). Browsers then display the literal characters instead of parsing them as tags. Named entities (&copy;, &nbsp;) and numeric entities (&#169;, &#xA9;) extend this pattern to symbols and any Unicode code point.

Decoding reverses the process for maintenance, CMS exports, and debugging—turning &lt;div&gt; back into <div> for inspection. Encoding is the security-critical direction when outputting untrusted text into HTML templates, innerHTML-adjacent contexts, or email HTML.

Quick answers

Concise answers for common searches — definitions, steps, and comparisons.

What characters must be HTML-encoded to prevent XSS?

In HTML text and attribute values, encode at minimum: ampersand (& → &amp;), less-than (< → &lt;), greater-than (> → &gt;), double quote (" → &quot;), and single quote (' → &#39; or &apos;) in attributes delimited by single quotes. Encoding & first prevents double-expansion when other entities are present. This neutralizes <script> and event-handler injection when output is inserted into HTML—not into script, style, or URL contexts.

When should you use HTML entities vs URL percent-encoding?

HTML entities (&amp;, &lt;, % not used) apply to HTML documents and email HTML so browsers do not interpret < and > as tags. URL percent-encoding (%26, %3C) applies to query strings, paths, and URI components per RFC 3986. Using &lt; in a URL breaks parsing; using %3C in HTML text does not produce a visible < in the page body. Pick the encoder matching your output context.

How do numeric HTML entities represent Unicode characters?

Decimal numeric entities use &#N; where N is the Unicode code point (e.g. &#8364; for €). Hexadecimal form is &#xN; (e.g. &#x20AC; for €). Named entities like &euro; are aliases for specific code points. Decoders map these to UTF-16/JavaScript strings; encoders in this tool emit decimal &#N; for characters without a predefined named mapping.

How HTML entity encoding works in this tool

Encode mode maps a fixed set of reserved characters to named entities and falls back to decimal numeric entities (&#code;) for other non-ASCII code points. Decode mode replaces known named entities, then resolves &#decimal; and &#xhex; sequences via String.fromCharCode.

Formula

Encode: & → &amp; · < → &lt; · > → &gt; · " → &quot; · ' → &#39; · other code points > 127 → &#N;
Decode: replace named entities → parse &#(\d+); → parse &#x([0-9A-Fa-f]+);

Limitations

  • Does not parse full HTML DOM trees—treats input as a plain string; use a sanitizer library for rich HTML allowlists
  • Invalid or incomplete entities (e.g. &amp without ;) may decode partially or leave literals unchanged
  • Not a substitute for framework auto-escaping in React, Vue, or server-side template engines

Sources

How to use HTML Entity Encoder & Decoder

  1. Choose encode or decode

    Select Encode to escape special characters for safe HTML output, or Decode to convert entity strings (e.g. &lt;div&gt;) back to plain text for editing or inspection.

  2. Paste your text

    Paste HTML snippets, template placeholders, CMS exports, or user comments. Enable Auto-convert to update the output field as you type, or press Ctrl+Enter to run once.

  3. Use examples or entity chips

    Click an example card (basic HTML, XSS sample, symbols) to load a demo. Use Common entities to insert frequently used characters without typing entity names.

  4. Copy the result

    Copy the output and paste into your template, test fixture, or documentation. For production sites, prefer framework auto-escaping (React JSX, template engines) in addition to manual encoding checks.

HTML Entity Encoder & Decoder examples

Escape angle brackets in markup

Input

<div class="card">Hello</div>

Output

&lt;div class=&quot;card&quot;&gt;Hello&lt;/div&gt;

Tags are neutralized so the string displays as source code in HTML rather than rendering a div—standard when showing code samples or sanitizing user HTML.

Neutralize a script injection

Input

<script>alert("xss")</script>

Output

&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;

Encoded output cannot execute as script when inserted into HTML text nodes. Pair encoding with Content-Security-Policy for defense in depth.

Decode entities from a CMS export

Input

&copy; 2026 &mdash; Price: 10&euro;

Output

© 2026 — Price: 10€

Decode mode restores human-readable text when you need to edit content that was stored entity-encoded in a database or export file.

Who uses HTML Entity Encoder & Decoder?

Common real-world scenarios where this tool saves time.

XSS-safe user comments and forum posts

Encode display names, post bodies, and bios before rendering in server templates or static HTML generators so injected tags cannot run in visitors' browsers.

Email and newsletter HTML

Escape dynamic merge fields (names, promo codes) in HTML emails where template engines might not auto-escape every insertion point.

Documentation and code samples

Show literal < and > in tutorials, API docs, and blog posts without the browser interpreting them as live HTML elements.

Debugging CMS and export data

Decode entity-heavy exports from WordPress, Drupal, or legacy systems to inspect the underlying text before re-encoding for a migration.

Workflow guides

Step-by-step chains that connect related tools for common tasks.

Sanitize a user comment for HTML display

  1. Paste the raw comment into Encode mode with Auto-convert enabled.
  2. Copy the encoded output and use it only in HTML text contexts (not inside <script> or event attributes).
  3. Validate surrounding markup with HTML Formatter if the page template mixes static and dynamic HTML.

Inspect CMS export then re-encode

  1. Paste entity-heavy export text into Decode mode to read the plain source.
  2. Edit the decoded text offline, then switch to Encode before publishing.
  3. For URL parameters embedded in the same content, encode links with URL Encoder separately from HTML entity encoding.

Reference tables

HTML entities vs other escaping layers

Developers often confuse HTML, URL, and JavaScript escaping—each targets a different parser.

ContextEscape formExampleWrong tool
HTML text nodeEntities< → &lt;URL %3C
URL query valuePercent-encoding& → %26&amp;
JavaScript stringJS/JSON escape" → \"&quot; in .js file
CSS contentCSS escape or Unicode' → \27&apos; in stylesheet
XML attributeEntities (similar)< → &lt;HTML-only rules in SVG/XML mixed docs

Encode at the boundary where data enters each format—once per context, not all layers on the same string.

When to use HTML Entity Encoder & Decoder vs related tools

Related toolUse this tool whenUse related tool when
HTML FormatterYou need to escape or decode entity strings in plain text before or after formatting markup.You have structured HTML to indent, minify, or validate—not just character-level entity transforms.
URL EncoderOutput is HTML or email body text requiring &lt; and &amp; style escapes.You are building query strings, redirect URIs, or path segments needing %20 and %26 encoding.
String EscaperDangerous characters appear in HTML template output.You need escapes for JSON, JavaScript, SQL, or regex string literals—not HTML display.

Common mistakes to avoid

Encoding already-encoded text twice

Double-encoding turns & into &amp;amp;. Decode once if unsure, then encode from plain text. In code, encode only at the output boundary, not on every save.

Using HTML entity encoding for URL query values

URLs need percent-encoding (%26, %3C), not &amp; or &lt;. Use the URL encoder for href and query parameters; use this tool for HTML document text.

Decoding untrusted content then using innerHTML

Decode is for trusted maintenance. Never decode attacker-controlled entities and assign to innerHTML—that restores executable markup.

Relying only on encoding inside JavaScript string literals

HTML entities do not protect JavaScript or CSS contexts. Use JSON.stringify for JS strings, CSS.escape for styles, and context-appropriate escaping per OWASP guidelines.

Troubleshooting

Decoded output still shows entity text

Likely cause: Malformed entities (missing semicolon) or double-encoded sequences

Fix: Ensure entities end with ;. If you see &amp;lt;, decode once, then inspect whether a second encode pass is needed.

Encoded text breaks in a JavaScript template literal

Likely cause: HTML escaping is the wrong context for JS source code

Fix: Use JSON.stringify or template-engine JS escaping. Reserve this tool for HTML body and attribute text destined for HTML parsers.

Non-ASCII characters become long &#…; sequences

Likely cause: Numeric entity fallback for code points above 127

Fix: Expected behavior for generic encoders. UTF-8 HTML pages can often store Unicode directly when the charset is UTF-8; entities remain useful for reserved symbols and legacy ASCII-only pipelines.

Advertisement

Frequently Asked Questions

What is an HTML entity?

An HTML entity is a character reference starting with & and ending with ; that represents a character—often one that is reserved in HTML syntax. Examples: &amp; for &, &lt; for <, &quot; for ", and &#169; or &copy; for ©.

Why encode user input before putting it in HTML?

Unencoded <, >, &, and quotes let attackers inject tags and scripts (XSS). Encoding converts them to harmless text so browsers display the characters literally instead of parsing markup.

What is the difference between named and numeric entities?

Named entities use readable names (&lt;, &copy;). Numeric entities use decimal (&#60;) or hexadecimal (&#x3C;) code points—required for characters without a named alias. Both decode to the same Unicode character.

Does this tool upload my text to a server?

No. Encoding and decoding run locally in JavaScript in your browser. Your HTML, templates, and user data never leave your device.

Can I decode HTML entities back to plain text?

Yes. Switch to Decode mode and paste entity strings such as &lt;p&gt;Hello&amp; World&lt;/p&gt;. The tool resolves named and numeric entities (&#…; and &#x…;) back to Unicode text.

Which characters must be encoded in HTML text?

At minimum: & → &amp;, < → &lt;, > → &gt;, " → &quot;, and often ' → &#39; in attribute values. Additional symbols (©, €, non-breaking space) use named or numeric entities when needed for display.

Is this HTML entity encoder free?

Yes—completely free with no signup, no usage limits, and no server upload. It runs entirely in your browser.

Privacy, accuracy, and trust

Privacy

All HTML entity encoding and decoding runs locally in your browser using JavaScript string operations. No text is uploaded, logged, or stored on any server.

Accuracy

Named entity mappings follow common HTML5 references; numeric encode/decode uses standard decimal and hex entity patterns. Output matches typical manual escaping for documentation and quick checks—not a certified HTML sanitizer.

For production user-generated HTML, combine encoding with framework auto-escaping and a vetted sanitizer library. This tool is for developers and content authors, not legal or security certification.

Related Tools

More free tools for the same workflow.

HTML Formatter

Free HTML formatter—beautify minified markup with 2 or 4 space indent, minify for production. Runs locally in your browser; no upload or signup.

Regex Tester

Free regex tester — highlight matches, capture groups, flags, and replace preview. JavaScript RegExp in your browser; patterns and text stay on your device, nothing uploaded.

URL Encoder & Decoder

Free URL encoder decoder for query values and full URLs—encodeURIComponent & encodeURI. Percent-encode or decode instantly in your browser; never uploaded.

Advertisement

Reviewed by EverydayTools Editorial Team on 2026-05-21.