HTML Entity Encoder Online

HTML Entity Encoding

This HTML entity encoder online converts special characters to named or numeric entities for safe HTML output. HTML entities are strings that begin with an ampersand (&) and end with a semicolon (;). They are used to display invisible characters and reserved characters (such as HTML tags) safely in a document.

You can find a complete list of named character references in the WHATWG specification.

In frontend development, to prevent XSS attacks, characters like <> are encoded as < and >. In practice, only six characters require encoding: &, <, >, ", ', and `.

Encoding Methods

HTML entities can be represented using either Unicode code points or named character references.

For example, <:

• Its named character reference is lt, so the entity is <
• Using '<'.codePointAt(), its Unicode code point is 60, so it can also be written as < (decimal) or < (hexadecimal)

Usage

Encoding Text

Enter raw text in the input field, and the tool will output the corresponding HTML entity encoding in real time. For example, entering <div> will produce <div>.

Decoding Entities

Paste an encoded entity string into the input field, and the tool will automatically restore it to readable text. Both named entities (e.g., &) and numeric entities (e.g., <) are supported.

Common Characters That Need Encoding

The following characters have special meaning in HTML and must be entity-encoded:

Preventing XSS Attacks

Always entity-encode user input before rendering it on a page. This prevents malicious scripts from being executed by the browser.

For example, if a user inputs <script>alert('xss')</script>, encoding converts it to plain text, so the browser will not treat it as executable code.

Typical scenarios:

1. Displaying user-generated content in comment sections and message boards
2. Reflecting URL parameters back onto the page
3. Content filtering in rich text editors

API

JavaScript

In JavaScript, you can use the he library for encoding and decoding:

he.encode('<div>hello</div>', { useNamedReferences: true })

he.decode(string)

FAQ

Q: What is the difference between HTML entity encoding and URL encoding?

HTML entity encoding is used to safely represent special characters within an HTML document — for example, encoding < as < so the browser does not interpret it as an HTML tag. URL encoding (also known as percent-encoding) is used to transmit special characters in URLs — for example, encoding a space as %20. The two serve entirely different purposes: HTML entity encoding operates at the rendering layer of page content, while URL encoding operates at the network transport layer. In practice, you need to choose the correct encoding method based on the context in which the data appears.

Q: Why is HTML entity encoding necessary?

Certain characters in HTML have special meaning, such as <, >, &, and ". If these characters are used directly on a page, the browser will interpret them as parts of HTML tags or attributes, potentially causing rendering errors or security vulnerabilities. Entity encoding converts these special characters into a safe form that the browser displays correctly. Additionally, entities can be used to insert characters that are hard to type on a keyboard, such as the copyright symbol © (©) or the trademark symbol ™ (™).

Q: What is the difference between named entities and numeric entities?

Named entities use human-readable names to represent characters — for example, & for & and < for <. They are easier to remember and read. Numeric entities use a character's Unicode code point, in either decimal (e.g., &) or hexadecimal (e.g., &) form. Not every character has a corresponding named entity — the HTML specification defines only a limited set — whereas numeric entities can theoretically represent any Unicode character. In terms of browser compatibility, numeric entities generally enjoy broader support.

Q: Do all characters need to be entity-encoded?

No. Only characters with special meaning in HTML must be encoded, primarily <, >, &, ", and '. Regular letters, numbers, and most punctuation marks can be used directly in HTML without encoding. For non-ASCII characters like Chinese or Japanese text, as long as the page declares the correct character encoding (e.g., UTF-8), entity encoding is unnecessary. However, in certain contexts (such as embedding content within HTML attribute values), you may need to encode additional characters for safety.

Q: Can entity encoding prevent XSS attacks?

HTML entity encoding is an important defense against XSS (Cross-Site Scripting) attacks, but it should not be relied upon as the sole protection. Encoding user input prevents attackers from injecting malicious HTML tags and JavaScript code. However, XSS prevention is a systemic effort that also requires Content Security Policy (CSP), input validation, and context-appropriate output encoding. For example, within JavaScript strings, URL attributes, or CSS styles, different encoding methods are needed — HTML entity encoding alone is not sufficient.