HTML Entity Encoder/Decoder — Encode & Decode HTML Entities

How HTML Entities Works

Encode: & &amp; | < &lt; | > &gt; | " &quot; | ' &#39; Decode: Named (&amp; → &), Decimal (&#38; → &), Hex (&#x26; → &)

HTML entity encoding converts special characters (like <, >, &, ", ') into their corresponding HTML entity references so they display correctly in web pages without being interpreted as markup. Decoding reverses this process, converting entity references back to their original characters. Three formats are supported: named entities (&amp;), decimal numeric entities (&#38;), and hexadecimal entities (&#x26;).

&amp;

Named Entity — A mnemonic name for a character preceded by an ampersand and followed by a semicolon. Examples: &amp; for &, &lt; for <, &gt; for >.

&#38;

Decimal Numeric Entity — A character reference using its Unicode code point in decimal format. The format is &# followed by the decimal number and a semicolon.

&#x26;

Hexadecimal Numeric Entity — A character reference using its Unicode code point in hexadecimal format. The format is &#x followed by the hex number and a semicolon.

HTML Context

HTML Parsing Context — The HTML spec defines where entity parsing applies. Entities are resolved in HTML content but not inside <script> or <style> blocks in modern browsers, though they should still be encoded for safety.

How to Use

1. Select the mode: "Encode to Entities" to convert special characters, or "Decode to Text" to convert entities back.
2. Enter or paste your input text in the text area — either raw text with special characters or text containing HTML entities.
3. View the encoded or decoded output result, along with character counts for both input and output.

Quick Reference

Common Uses

• •Displaying code snippets on blogs and documentation sites without breaking the page layout
• •Sanitizing user-generated content before rendering it in web applications to prevent XSS attacks
• •Encoding special characters in HTML email templates to ensure consistent rendering across email clients
• •Processing scraped web content that contains encoded characters back into readable text
• •Preparing data for XML documents where certain characters have special meaning and must be escaped

Understanding the Result

HTML entity encoding is a fundamental security and display technique in web development. When a web browser encounters HTML markup, it parses angle brackets (< >) as tag delimiters, ampersands (&) as entity starters, and quotes as attribute delimiters. If user-generated content or dynamic data containing these characters is inserted directly into HTML without encoding, it can break page rendering or introduce cross-site scripting (XSS) vulnerabilities. The encoding process converts these five essential characters into their corresponding entity references: & becomes &amp;, < becomes &lt;, > becomes &gt;, " becomes &quot;, and ' becomes &#39; (or &apos; in XHTML). The decoding process is more complex because there are three formats in widespread use. Named entities like &amp;, &lt;, and &copy; are defined by the HTML specification and provide human-readable mnemonics. Decimal numeric entities like &#38; reference characters by their Unicode code point in base 10. Hexadecimal numeric entities like &#x26; use base 16, which can be more convenient when referring to code points from Unicode charts. The HTML5 specification defines 2231 named character entities covering a wide range of symbols, punctuation, and international characters. When decoding, the entity parser must handle all three formats, plus edge cases like missing semicolons (which are tolerated in certain contexts per the HTML spec), invalid code points, and entities that decode to non-printable characters. This tool handles the full range of named entities and properly processes both decimal and hexadecimal numeric entities for comprehensive encoding and decoding support.

Frequently Asked Questions

What characters should always be HTML-encoded?

The five essential characters are: & (ampersand), < (less-than), > (greater-than), " (double quote), and ' (single quote/ apostrophe). The ampersand and less-than are the most critical because they directly affect how the browser parses HTML markup. Everything else is optional but recommended for special or non-ASCII characters.

Is HTML encoding the same as URL encoding?

No. HTML encoding uses entities like &amp;lt; to display characters safely in HTML documents. URL encoding (also called percent-encoding) uses %20 for spaces and similar patterns to make data safe for URLs. They serve different purposes and are not interchangeable. For example, a space is &amp;nbsp; in HTML but %20 in a URL.

Does encoding prevent XSS attacks?

HTML entity encoding is a critical defense against XSS but is not sufficient on its own. It prevents injection when inserting data into HTML body content but does not protect when inserting into <script> tags, event handlers (onclick), or CSS. A comprehensive XSS prevention strategy uses context-specific encoding (HTML, JavaScript, CSS, URL) combined with content security policies (CSP).

What is the difference between &#39; and &apos;?

Both represent the apostrophe/single quote character ('). &apos; is defined in the XHTML and XML specifications but is NOT a valid HTML4 entity. &#39; (the decimal numeric entity) works in all versions of HTML. For maximum compatibility, &#39; is preferred over &apos; when encoding apostrophes in HTML documents.

Sources

• HTML Living Standard — Character References
• Cross-Site Scripting (XSS) Prevention on OWASP