What are HTML entities?
HTML entities are codes that represent characters reserved by HTML — like < and > which mark the start and end of tags, and & which begins entity references. If you want to display a literal < in a page without the browser treating it as a tag, you write < instead. Encoding user-supplied text before inserting it into HTML is one of the most critical steps to prevent cross-site scripting (XSS) attacks.
How to use this tool
- 1 Choose Encode to convert reserved HTML characters to their entity equivalents, or Decode to reverse HTML entities back to their original characters.
- 2 Paste your HTML or plain text — the output updates instantly.
- 3 The encoded output replaces & with &, < with <, > with >, " with ", and ' with '.
- 4 Use the Swap button to copy the output back to the input for further processing.
Frequently asked questions
Which characters get encoded?
The five characters with special meaning in HTML: & (ampersand) becomes &, < (less-than) becomes <, > (greater-than) becomes >, " (double quote) becomes ", and ' (single quote) becomes '. These cover the full set required to prevent XSS when inserting text into HTML elements and attributes.
Is this safe to use for XSS prevention?
This tool encodes the five characters that matter for HTML contexts. For robust XSS prevention in production code, always use your framework's built-in escaping (React does it by default; Jinja2 auto-escapes; etc.) rather than rolling your own. Context matters — the rules differ for attributes, scripts, CSS, and URL parameters.
What is the difference between Encode and Decode?
Encode takes raw text and replaces special characters with their &entity; equivalents so a browser renders them as visible characters rather than HTML markup. Decode does the reverse: <h1> becomes <h1>.
Is my data sent anywhere?
No. Encoding uses plain string replacement; decoding uses a temporary textarea element in your browser's DOM. Nothing is uploaded or transmitted.
Why does decoding insert unexpected characters?
Some entity sequences — like (non-breaking space), — (em dash), or numeric references like ❤ — decode to Unicode characters that may look unusual in a monospace font but are correct. The browser's HTML parser handles all named and numeric entities during decoding.