HTML Entity Encoder & Decoder Online

HTML entities are special sequences of characters used to represent reserved or hard-to-type characters in HTML documents. Every entity starts with an ampersand (&) and ends with a semicolon (;). For example, < represents the less-than sign (<), which would otherwise be interpreted as the beginning of an HTML tag by the browser. HTML entities serve three main purposes: they allow you to safely display characters that have special meaning in HTML markup (like angle brackets and ampersands), they provide a way to insert characters that cannot be typed directly on most keyboards (like copyright symbols, em dashes, and currency signs), and they ensure correct rendering across different character encoding configurations. The HTML specification defines over 2,000 named entities, and numeric entity references can represent any of the 143,000-plus characters in the Unicode standard. Understanding entities is a fundamental skill for web developers, content authors, and anyone who works with HTML source code directly.

Encoding HTML entities is essential for both security and correct rendering of web content. From a security perspective, encoding prevents cross-site scripting (XSS) attacks, which are among the most common and dangerous web vulnerabilities. When user-supplied text is inserted into a web page without encoding, an attacker can inject malicious scripts that steal cookies, session tokens, personal data, or redirect users to phishing sites. By encoding special characters like <, >, &, ", and ', you ensure the browser treats them as displayable text rather than executable markup. From a rendering perspective, unencoded ampersands and angle brackets can cause browsers to misinterpret your content, leading to broken layouts, missing text, or invalid HTML. Every security framework recommends output encoding as a primary defense against injection attacks, and HTML validators require proper encoding for the document to pass validation. Whether you are building a blog, an e-commerce platform, or a web application, encoding HTML entities is a non-negotiable best practice.

Named entities use a human-readable alias that describes the character, such as & for the ampersand, © for the copyright symbol, or ♥ for the heart symbol. They are easier to read and understand in source code, making maintenance simpler. However, only a subset of Unicode characters have named entities defined in the HTML specification. Numeric entities use the character's Unicode code point and can represent any character in the entire Unicode standard. Decimal numeric entities follow the format &# plus the decimal code point plus a semicolon (for example, © for the copyright symbol). Hexadecimal numeric entities use &#x plus the hex code point (for example, ©). In practice, named entities are preferred for common characters because they are self-documenting, while numeric entities are used for characters that lack a named entity or when maximum compatibility with older parsers is required. Both forms are supported by all modern web browsers.

Cross-site scripting (XSS) attacks rely on injecting HTML or JavaScript code into a web page that other users will view. The attack works because the browser cannot distinguish between legitimate markup written by the developer and malicious markup injected through user input. HTML entity encoding breaks this attack chain by converting the characters that form HTML syntax into entity references that the browser renders as visible text. When a less-than sign becomes <, the browser displays the character "<" on the page instead of interpreting it as the start of a tag. Similarly, encoding quotes prevents attackers from breaking out of HTML attribute values to inject event handlers like onmouseover or onerror. This technique is called output encoding or contextual escaping, and it is recommended by every major web security standard including the OWASP Application Security Verification Standard, the OWASP XSS Prevention Cheat Sheet, and the W3C security guidelines. It should be applied every time user-controlled data is inserted into an HTML context.

Five characters have special syntactic meaning in HTML and must always be encoded when they appear as literal text content or attribute values. The ampersand (&) must be encoded as & because it signals the beginning of an entity reference. The less-than sign (<) must be encoded as < because it signals the beginning of an HTML tag. The greater-than sign (>) should be encoded as > to prevent ambiguity in closing contexts. The double quotation mark (") must be encoded as " when used inside attribute values delimited by double quotes. The single quotation mark or apostrophe (') must be encoded as ' or ' when used inside attribute values delimited by single quotes. Failing to encode any of these characters can result in broken HTML, incorrect page rendering, or exploitable security vulnerabilities depending on the context in which the unencoded character appears.

UTF-8 is a character encoding that can represent every character in the Unicode standard directly as a sequence of bytes. When an HTML document declares <meta charset="UTF-8">, the browser knows how to interpret the raw bytes of the file as specific characters, allowing you to include accented letters, CJK characters, emoji, and other symbols directly in your source code without using entities. However, the five reserved HTML characters (ampersand, less-than, greater-than, double quote, and single quote) must still be encoded regardless of the character set because they control HTML syntax. HTML entities remain useful even in a UTF-8 world for several reasons: they provide a way to include invisible characters like non-breaking spaces and zero-width joiners that are impossible to distinguish from regular spaces in a text editor; they serve as a fallback for systems that do not handle UTF-8 correctly, such as certain email templates and legacy content management systems; and they make source code more explicit when dealing with characters that look similar to other characters.

The most frequently used HTML entities fall into several categories. The five essential entities for security and correct HTML are & (ampersand), < (less-than), > (greater-than), " (double quote), and ' (apostrophe). Typographic entities are widely used in professional content: — (em dash), – (en dash), … (ellipsis), « and » (angle quotation marks), and   (non-breaking space). Legal and business symbols include © (copyright), ® (registered trademark), and ™ (trademark). Currency entities such as € (euro), £ (pound), ¥ (yen), and ¢ (cent) are common in e-commerce and financial content. Mathematical entities like × (multiplication), ÷ (division), ± (plus-minus), ≠ (not equal), ≤ (less-than or equal), ≥ (greater-than or equal), and ∞ (infinity) appear frequently in technical and scientific documentation.