An html entity encoder solves a problem every web developer hits: you want to display the literal text <div> on a page, but the browser interprets it as an actual tag. The fix is converting special characters into HTML entities — <, >, & — so they render as text instead of markup. It is also the first step in safely displaying user input without breaking your page.
This free tool encodes HTML into entities and decodes entities back to text, live as you type. Choose named entities (&), decimal (&), or hex (&), copy the result with one click, and use the click-to-copy cheat sheet for the entities you’ll need most. Bloggers, developers, and students all run into escaping issues — this html entity encoder resolves them instantly. No signup, no watermarks, everything in your browser.
HTML Entity Encoder
Escape HTML to entities — or decode entities back to text.
| Character | Named | Decimal | Hex |
|---|---|---|---|
| & | |||
| < | |||
| > | |||
| " | |||
| ' | |||
| © | |||
| ® | |||
| € | |||
| — | |||
| ␣ |
🔒 100% private — everything runs in your browser, nothing is uploaded.
How to Use the HTML Entity Encoder
- Stay on the Encode → entities tab and paste your HTML or text into the input box — output updates live.
- Pick an entity style: Named (
&), Decimal (&), or Hex (&). - Click Copy to grab the encoded output.
- To go the other way, switch to the Decode → text tab and paste entity-laden HTML — it converts back to readable text.
- Need a single entity fast? Click any cell in the cheat sheet to copy it.
Features That Set This Tool Apart
- Two-way conversion — encode HTML to entities and decode entities back to text on one page.
- Three entity styles — named, decimal, and hex output, switchable live.
- Live as you type — no buttons to press; the output follows your input.
- Unicode-aware — handles emoji and astral-plane characters via code points, not broken surrogates.
- Click-to-copy cheat sheet — the ten entities you’ll actually need, in all three styles.
- Private by design — encoding happens on your device; your markup is never uploaded.
What Are HTML Entities?
HTML entities are special sequences that represent characters with reserved or invisible meaning in HTML. They always start with & and end with ;. The three characters you must escape in HTML content are < (<), > (>), and & itself (&) — plus " inside attribute values. Without escaping, the browser parses your text as markup: documentation about the <div> tag would vanish into an actual div.
Beyond the reserved characters, entities give you access to characters that are hard to type or invisible: for a non-breaking space, © for ©, — for —, € for €. An html entity encoder handles both jobs: escaping the dangerous characters and converting the decorative ones into portable sequences that survive any encoding mismatch between your editor and the browser.
Named vs Decimal vs Hex: Which Entity Style to Use
Every entity can be written three ways. Named entities (&, <, ©) are the most readable — anyone maintaining the HTML can see what character was intended. Decimal numeric references (&) and hex references (&) are universal: they work for every Unicode character, including ones with no named entity, like emoji (😀).
The practical guidance: use named entities for the common cases in hand-written HTML, because readability wins. Use numeric references when generating markup programmatically or when you need characters outside the named set. Avoid mixing styles in one document for consistency. One more rule: always include the trailing semicolon — & without it is technically parsed by browsers in some positions, but it is invalid HTML and a classic source of subtle bugs. This html entity encoder always emits the semicolon.
Entities, Escaping, and XSS: What Encoding Does and Doesn’t Do
Escaping user input into HTML entities is the first line of defense against cross-site scripting (XSS): if a comment containing <script> is entity-encoded before being inserted into a page, the browser renders it as text instead of executing it. That is precisely what an html entity encoder does, and for simple server-rendered pages, encoding output is the correct core mitigation.
But encoding is not a magic shield. It protects HTML content and attribute contexts — it does not make data safe inside <script> blocks, event-handler attributes, CSS, or URLs, where different escaping rules apply. Modern frameworks (React, Vue, Angular) escape by default when you interpolate values, which covers most cases automatically; the danger zone is manual innerHTML assignments and server templates with “raw” output modes. Rule of thumb: encode at the moment you insert untrusted data into HTML, use your framework’s safe interpolation everywhere else, and treat any tool that promises “XSS protection” from encoding alone with skepticism.
HTML Entity Encoder: Frequently Asked Questions
What is an HTML entity?
An HTML entity is a sequence like & or & that represents a character with special meaning in HTML. Entities start with & and end with a semicolon. They let you display reserved characters (like < and >) as text, include invisible characters like the non-breaking space, and insert symbols like © and € that may be awkward to type or could be mangled by encoding mismatches.
When do I need to encode HTML entities?
Encode whenever you want the browser to display markup as text rather than parse it: code documentation, blog posts showing HTML examples, user comments containing < or >, and attribute values containing quotes. You also encode untrusted user input before inserting it into a page to prevent cross-site scripting. If your text contains <, >, or & and you want them visible, encoding is required.
What is the difference between named, decimal, and hex entities?
Named entities like & are readable words for common characters; decimal references like & and hex references like & are numeric codes that work for every Unicode character. Named is best for hand-written HTML readability, numeric is best for programmatic generation and characters with no name (like emoji). All three render identically in the browser — pick one style and stay consistent.
How do I decode HTML entities back to text?
Switch to the Decode tab above and paste your entity-encoded HTML — it converts back to plain text instantly. Decoding is useful when you receive escaped content from an API or a CMS and need the readable original, or when you want to check what an encoded snippet actually says. Browsers decode entities automatically when rendering; this tab just shows you the underlying text.
Does encoding entities prevent XSS attacks?
Encoding user input into entities is the correct core defense against XSS in HTML content and attribute contexts: an encoded script tag renders as text instead of executing. But it does not protect JavaScript blocks, event handlers, CSS, or URLs, which need different escaping. Modern frameworks escape interpolated values by default. Encode untrusted data at insertion time, and never rely on encoding alone inside script or style contexts.
Related Free Tools
- Base64 Encoder/Decoder — encode binary data and text as safe ASCII.
- URL Encoder/Decoder — percent-encode text for URLs and query strings.
- Binary Translator — translate between text, binary, hex, octal, and decimal.
- All Free Tools — browse the complete collection of free online tools.
Displaying code on a page, escaping user input, or decoding an API’s escaped payload — an html entity encoder handles all of it in seconds. This one works both directions, offers named, decimal, and hex styles, updates live, and keeps a click-to-copy cheat sheet of the entities you’ll reach for most. Everything runs in your browser. Paste your markup and watch the angle brackets turn harmless.