HTML Entities Encoder / Decoder
Escape and unescape HTML special characters with full non-ASCII support.
What this tool does
HTML entities are character references used to represent reserved or invisible characters in HTML documents. They are essential for displaying characters that have special meaning in HTML markup (<, >, &, ", '), for rendering non-ASCII characters in legacy encodings, and for preventing cross-site scripting (XSS) by escaping user-supplied content.
This tool encodes text to HTML entities and decodes entity references back to their original characters. It supports both named entities (&, <, ©) and numeric references (&, <, ©), including hex references (&). This is invaluable when you need to display HTML code in a webpage, embed user content safely, or debug character encoding issues.
Usage Example
<!-- Input -->
<script>alert("XSS")</script>
<!-- Encoded (safe to embed in HTML) -->
<script>alert("XSS")</script>
<!-- Named entities -->
© 2024 — All rights reserved
♥ ∞ ™Common Edge Cases
- Double-encoding (encoding an already-encoded string) produces garbled output because the & in & becomes &amp; after a second pass.
- Attribute values should be quoted and the inner content escaped. Unquoted attributes are vulnerable to injection through whitespace and > characters.
- Numeric entities must end with a semicolon, except in legacy HTML where some entities work without it. Always include the semicolon for safety.
- UTF-8 has replaced most named entities for non-ASCII characters, but ©, ®, and ™ are still widely used in HTML.
- The JavaScript context is separate from HTML; HTML entity encoding does not prevent XSS inside <script> tags or event handler attributes.
FAQ
- Does HTML entity encoding prevent XSS?
- Only in HTML context. To prevent XSS in JavaScript, URL parameters, or CSS, you need context-specific encoding: JavaScript encoding for <script> blocks, URL encoding for query parameters, and CSS encoding for style values.
- Should I use named or numeric entities?
- Named entities (&) are more readable but limited to a few hundred defined names. Numeric entities (&) support the entire Unicode range and are more portable across older browsers and tools.
- Why is my emoji showing as 😀?
- Emojis are outside the Basic Multilingual Plane, so they require surrogate pairs in UTF-16 and 4-byte sequences in UTF-8. Numeric entities let you reference any Unicode code point including emojis.