📖 What is HTML Entity Encoder?
An HTML entity encoder converts special characters like <, >, & and quotes into their safe HTML entity equivalents (<, >, &), so browsers display them as text instead of interpreting them as markup. The decoder does the reverse — turning entities back into readable characters.
Developers use entity encoding whenever user input or code snippets need to be shown inside an HTML page. Without it, a string like <script> would be executed by the browser instead of displayed. All encoding happens in your browser — your text never leaves your computer.
💡 Example
Input
<div class="msg">Tom & Jerry say "hi"</div>
Output
<div class="msg">Tom & Jerry say "hi"</div>
The 5 essential HTML entities
< → < (less-than, opens tags)> → > (greater-than, closes tags)& → & (ampersand, starts entities)" → " (double quote, breaks attributes)' → ' (single quote / apostrophe)
🛠️ Common Use Cases
- Displaying HTML, JSX or XML code snippets inside a web page, blog post or documentation site
- Safely rendering user-generated content (comments, usernames, form input) to prevent broken layouts and XSS injection
- Escaping
& characters in URLs placed inside href attributes
- Fixing double-encoded text such as
&amp; appearing on a page
- Preparing code examples for CMS editors, email templates and Markdown that allow raw HTML
🛡️ Entity Encoding vs Sanitization
Encoding makes every special character display as plain text — nothing is removed, nothing executes. Sanitization filters HTML, keeping safe tags (like <b>) while stripping dangerous ones (like <script>).
Rule of thumb: if the text should never render as HTML, encode it. If users are allowed limited formatting (e.g. a rich-text comment box), sanitize it with a vetted library. Encoding alone is the safer default for untrusted input. For a full walkthrough with code examples, read our guide: HTML Entities Explained: When to Use <, >, & and Quotes →
Common mistakes
- Double-encoding — running already-encoded text through the encoder again, producing
&lt;
- Forgetting to encode
& first when encoding manually, which corrupts the other entities
- Encoding entire HTML documents you actually want rendered — only encode the parts meant to display as text
- Relying on entity encoding inside
<script> blocks or URLs — those contexts need JavaScript or URL escaping instead
❓ Frequently Asked Questions
What characters must always be encoded in HTML? ▾
Five characters are essential: < (<), > (>), & (&), double quote (") and single quote ('). The first three break page structure; the quotes break HTML attributes.
Does HTML entity encoding prevent XSS attacks? ▾
It prevents XSS when untrusted text is placed in HTML body or attribute contexts, because tags can no longer execute. It is not sufficient inside script blocks, inline event handlers or URLs — those need context-specific escaping.
What is the difference between named and numeric entities? ▾
Named entities use a readable name like © for ©, while numeric entities use the character code, like © (decimal) or © (hex). Browsers treat them identically; numeric entities work for every Unicode character.
Why does my page show & instead of &? ▾
That is double encoding — text that was already encoded was encoded again. Run it through the decoder once to fix it, and check your pipeline so encoding happens exactly one time, at output.
Is my data private? ▾
Yes — encoding and decoding run entirely in your browser with JavaScript. Nothing you paste is uploaded or stored on any server.
Is this tool free? ▾
Completely free — no login, no usage limits, and it keeps working offline once the page is loaded.
🔒
Your data stays private. All processing happens entirely in your browser using JavaScript. Nothing is ever sent to our servers. You can even use this tool offline after the page loads.