Encoders & Decoders

HTML Entity Encoder / Decoder

Encode or decode HTML entities in named, decimal, or hex format. Swap encode ↔ decode with one click — runs entirely in your browser.

Encode & Decode
Named / Decimal / Hex
One-Click Swap
Browser-only

Plain text

Output will appear here

Understanding HTML Character Entities & Encoding

HTML entity encoding is a vital security and formatting technique that converts reserved HTML characters into character references (such as & or <). This prevents user-provided input from being executed as active browser markup, eliminating Cross-Site Scripting (XSS) injection attacks and ensuring special typography displays accurately.

Essential HTML Reserved Entities

Character	Entity Name	Decimal Code	Hexadecimal Code	Description
`&`	`&`	`&`	`&`	Ampersand sign
`<`	`<`	`<`	`<`	Less-than sign (opening tag)
`>`	`>`	`>`	`>`	Greater-than sign (closing tag)
`"`	`"`	`"`	`"`	Double quotation mark
`'`	`'`	`'`	`'`	Apostrophe / single quote
`©`	`©`	`©`	`©`	Copyright symbol
`€`	`€`	`€`	`€`	Euro currency symbol
`£`	`£`	`£`	`£`	British Pound sterling symbol

Named vs Numeric Character References

Named Entities (©, —): Human-readable and intuitive to write in source files, but limited to entities recognized by HTML specifications.
Decimal Entities (©): Directly references Unicode code points in base-10.
Hex Entities (©): Directly references Unicode code points in base-16; universal across XML, XHTML, and HTML.

Encoding and Decoding Entities in Code

JavaScript

// Safe entity encoding function
function encodeHtmlEntities(rawString) {
  return rawString.replace(/[&<>"']/g, (char) => {
    const map = {
      '&': '&amp;',
      '<': '&lt;',
      '>': '&gt;',
      '"': '&quot;',
      "'": '&#39;',
    };
    return map[char];
  });
}

// Entity decoding function
function decodeHtmlEntities(encodedString) {
  const doc = new DOMParser().parseFromString(encodedString, 'text/html');
  return doc.body.textContent || "";
}

Python (html module)

import html

unsafe = '<div class="alert">Notice: 5 > 2 & 10 < 20</div>'
safe_html = html.escape(unsafe)
print(safe_html)
# Output: &lt;div class=&quot;alert&quot;&gt;Notice: 5 &gt; 2 &amp; 10 &lt; 20&lt;/div&gt;

Preventing Code Injection & Security Best Practices

Context-Aware Escaping: Escaping requirements differ across HTML body text, attribute values, JavaScript string literals, and URI parameters. A single encoding scheme is insufficient for all contexts.
Preventing Double Encoding: Always verify whether a string is already encoded before applying transformations, avoiding malformed outputs like &amp;.
Character Encoding Declarations: Always specify <meta charset="utf-8"> at the start of HTML documents to prevent character encoding confusion attacks.

Frequently Asked Questions

What is the difference between named, decimal, and hexadecimal HTML entities?: Named entities use mnemonic words (such as ©), decimal entities reference Unicode code points in base 10 (such as ©), and hexadecimal entities reference code points in base 16 (such as ©). All three render identically in modern web browsers.
Which characters must always be escaped in HTML attribute values?: Double quotes ("), single quotes ('), and ampersands (&) must always be escaped inside HTML attributes to prevent attackers from breaking out of attribute strings and executing malicious scripts.
What is an HTML entity?: HTML entities are special character sequences used to represent reserved characters in HTML. For example, < becomes <, > becomes >, & becomes &, and " becomes ".
What is the difference between named and numeric entities?: Named entities use readable names (e.g. &). Numeric entities use the Unicode code point in decimal (&#38;) or hex (&#x26;) form. Both are interpreted identically by browsers.
When should I encode HTML entities?: Always encode user-supplied content before inserting it into HTML to prevent XSS (Cross-Site Scripting) attacks. Also encode entities in HTML attributes, email templates, and XML documents.
Does this tool encode all characters?: The tool uses standard HTML5 named entities when available and falls back to decimal or hexadecimal numeric entities for characters without a named form, including other Unicode characters.

Accuracy & Advisory Notice: HTML Entity Encoder / Decoder

This website and utility are provided for general informational, calculation, and educational purposes only. Always verify critical computation outputs prior to professional deployment or financial use. See our Terms of Service and Privacy Policy for full governance details.

Loading tool...

Understanding HTML Character Entities & Encoding

Essential HTML Reserved Entities

Character

Entity Name

Decimal Code

Hexadecimal Code

Description

&

Ampersand sign

<

Less-than sign (opening tag)

>

Greater-than sign (closing tag)

"

Double quotation mark

'

Apostrophe / single quote

©

€

Euro currency symbol

£

British Pound sterling symbol

Named vs Numeric Character References

Named Entities (©, —): Human-readable and intuitive to write in source files, but limited to entities recognized by HTML specifications.

Decimal Entities (©): Directly references Unicode code points in base-10.

Hex Entities (©): Directly references Unicode code points in base-16; universal across XML, XHTML, and HTML.

Encoding and Decoding Entities in Code

JavaScript

// Safe entity encoding function function encodeHtmlEntities(rawString) { return rawString.replace(/[&<>"']/g, (char) => { const map = { '&': '&', '<': '<', '>': '>', '"': '"', "'": ''', }; return map[char]; }); } // Entity decoding function function decodeHtmlEntities(encodedString) { const doc = new DOMParser().parseFromString(encodedString, 'text/html'); return doc.body.textContent || ""; }

Python (html module)

import html unsafe = '<div class="alert">Notice: 5 > 2 & 10 < 20</div>' safe_html = html.escape(unsafe) print(safe_html) # Output: <div class="alert">Notice: 5 > 2 & 10 < 20</div>

Preventing Code Injection & Security Best Practices

Context-Aware Escaping: Escaping requirements differ across HTML body text, attribute values, JavaScript string literals, and URI parameters. A single encoding scheme is insufficient for all contexts.

Preventing Double Encoding: Always verify whether a string is already encoded before applying transformations, avoiding malformed outputs like &amp;.

Character Encoding Declarations: Always specify <meta charset="utf-8"> at the start of HTML documents to prevent character encoding confusion attacks.

Frequently Asked Questions

What is the difference between named, decimal, and hexadecimal HTML entities?

Named entities use mnemonic words (such as ©), decimal entities reference Unicode code points in base 10 (such as ©), and hexadecimal entities reference code points in base 16 (such as ©). All three render identically in modern web browsers.

Which characters must always be escaped in HTML attribute values?

Double quotes ("), single quotes ('), and ampersands (&) must always be escaped inside HTML attributes to prevent attackers from breaking out of attribute strings and executing malicious scripts.

What is an HTML entity?

HTML entities are special character sequences used to represent reserved characters in HTML. For example, < becomes <, > becomes >, & becomes &, and " becomes ".

What is the difference between named and numeric entities?

Named entities use readable names (e.g. &). Numeric entities use the Unicode code point in decimal (&#38;) or hex (&#x26;) form. Both are interpreted identically by browsers.

When should I encode HTML entities?

Always encode user-supplied content before inserting it into HTML to prevent XSS (Cross-Site Scripting) attacks. Also encode entities in HTML attributes, email templates, and XML documents.

Does this tool encode all characters?

The tool uses standard HTML5 named entities when available and falls back to decimal or hexadecimal numeric entities for characters without a named form, including other Unicode characters.