could execute in browsers. Always encode user-generated content."}},{"@type":"Question","name":"What is the difference between named and numeric HTML entities?","acceptedAnswer":{"@type":"Answer","text":"Named entities use descriptive names like & for & and © for ©. Numeric entities use character codes: decimal (&) or hexadecimal (&). Named entities are more readable, but numeric entities work for any Unicode character."}},{"@type":"Question","name":"Which HTML characters must always be encoded?","acceptedAnswer":{"@type":"Answer","text":"The five essential characters to encode are: & (ampersand) → &, < (less than) → <, > (greater than) → >, \" (double quote) → ", and ' (single quote) → ' or '. These prevent HTML parsing issues and XSS vulnerabilities."}},{"@type":"Question","name":"What is and when should I use it?","acceptedAnswer":{"@type":"Answer","text":" is a non-breaking space entity. Unlike regular spaces, browsers won't collapse multiple entities together, and text won't wrap at a non-breaking space. Use it for: multiple consecutive spaces, keeping words together (e.g., \"100 km\"), and table cell spacing."}},{"@type":"Question","name":"How do I display HTML code as text on a webpage?","acceptedAnswer":{"@type":"Answer","text":"Encode all HTML tags so they display as text instead of being rendered. Convert

to <div class="example">. This is essential for code tutorials, documentation, and displaying user-submitted HTML safely."}},{"@type":"Question","name":"Should I encode all characters or just special ones?","acceptedAnswer":{"@type":"Answer","text":"For basic HTML safety, encode only the 5 essential characters (<, >, &, \", '). Use \"Encode All\" mode to also encode non-ASCII characters (accented letters, symbols, emoji) as numeric entities for maximum compatibility with older systems or ASCII-only environments."}},{"@type":"Question","name":"How do I encode Unicode and emoji in HTML?","acceptedAnswer":{"@type":"Answer","text":"Unicode characters can be encoded as numeric entities: decimal (😀 for 😀) or hexadecimal (😀). However, if your HTML uses UTF-8 encoding (recommended), you can include Unicode characters directly without entities."}},{"@type":"Question","name":"What are the most common HTML entities?","acceptedAnswer":{"@type":"Answer","text":"Common entities include: (non-breaking space), & (ampersand), < (less than), > (greater than), " (double quote), © (©), ® (®), ™ (™), € (€), £ (£), — (—), and … (…)."}},{"@type":"Question","name":"How do I decode HTML entities in JavaScript?","acceptedAnswer":{"@type":"Answer","text":"Create a temporary element and use innerHTML: const div = document.createElement(\"div\"); div.innerHTML = encodedString; return div.textContent; Or use the DOMParser API. For encoding, replace characters manually or use a library like he.js."}},{"@type":"Question","name":"What is the difference between HTML encoding and URL encoding?","acceptedAnswer":{"@type":"Answer","text":"HTML encoding uses entities like & for display in HTML documents. URL encoding uses percent-encoding like %26 for safe transmission in URLs. Use HTML encoding for webpage content and URL encoding for query parameters and links."}},{"@type":"Question","name":"How do I prevent XSS attacks with HTML encoding?","acceptedAnswer":{"@type":"Answer","text":"Always encode user input before displaying it in HTML. Encode the 5 essential characters at minimum. Use context-appropriate encoding (HTML entities for content, URL encoding for URLs, JavaScript encoding for scripts). Never trust user input."}},{"@type":"Question","name":"Is my data secure when using this HTML entity encoder?","acceptedAnswer":{"@type":"Answer","text":"Yes! All encoding and decoding happens 100% in your browser using JavaScript. Your HTML content never leaves your device or gets sent to any server, making it safe for encoding sensitive content and testing XSS prevention."}}]},{"@type":"HowTo","name":"How to use HTML Entity Encoder/Decoder","description":"Step-by-step guide to using HTML Entity Encoder/Decoder","step":[{"@type":"HowToStep","position":1,"name":"Step 1","text":"Choose Encode or Decode mode"},{"@type":"HowToStep","position":2,"name":"Step 2","text":"Enable \"Encode All\" for special characters"},{"@type":"HowToStep","position":3,"name":"Step 3","text":"Paste your HTML or text"},{"@type":"HowToStep","position":4,"name":"Step 4","text":"Copy the encoded/decoded result"}]}]} could execute in browsers. Always encode user-generated content."},{"question":"What is the difference between named and numeric HTML entities?","answer":"Named entities use descriptive names like & for & and © for ©. Numeric entities use character codes: decimal (&) or hexadecimal (&). Named entities are more readable, but numeric entities work for any Unicode character."},{"question":"Which HTML characters must always be encoded?","answer":"The five essential characters to encode are: & (ampersand) → &, < (less than) → <, > (greater than) → >, \" (double quote) → ", and ' (single quote) → ' or '. These prevent HTML parsing issues and XSS vulnerabilities."},{"question":"What is and when should I use it?","answer":" is a non-breaking space entity. Unlike regular spaces, browsers won't collapse multiple entities together, and text won't wrap at a non-breaking space. Use it for: multiple consecutive spaces, keeping words together (e.g., \"100 km\"), and table cell spacing."},{"question":"How do I display HTML code as text on a webpage?","answer":"Encode all HTML tags so they display as text instead of being rendered. Convert

to <div class="example">. This is essential for code tutorials, documentation, and displaying user-submitted HTML safely."},{"question":"Should I encode all characters or just special ones?","answer":"For basic HTML safety, encode only the 5 essential characters (<, >, &, \", '). Use \"Encode All\" mode to also encode non-ASCII characters (accented letters, symbols, emoji) as numeric entities for maximum compatibility with older systems or ASCII-only environments."},{"question":"How do I encode Unicode and emoji in HTML?","answer":"Unicode characters can be encoded as numeric entities: decimal (😀 for 😀) or hexadecimal (😀). However, if your HTML uses UTF-8 encoding (recommended), you can include Unicode characters directly without entities."},{"question":"What are the most common HTML entities?","answer":"Common entities include: (non-breaking space), & (ampersand), < (less than), > (greater than), " (double quote), © (©), ® (®), ™ (™), € (€), £ (£), — (—), and … (…)."},{"question":"How do I decode HTML entities in JavaScript?","answer":"Create a temporary element and use innerHTML: const div = document.createElement(\"div\"); div.innerHTML = encodedString; return div.textContent; Or use the DOMParser API. For encoding, replace characters manually or use a library like he.js."},{"question":"What is the difference between HTML encoding and URL encoding?","answer":"HTML encoding uses entities like & for display in HTML documents. URL encoding uses percent-encoding like %26 for safe transmission in URLs. Use HTML encoding for webpage content and URL encoding for query parameters and links."},{"question":"How do I prevent XSS attacks with HTML encoding?","answer":"Always encode user input before displaying it in HTML. Encode the 5 essential characters at minimum. Use context-appropriate encoding (HTML entities for content, URL encoding for URLs, JavaScript encoding for scripts). Never trust user input."},{"question":"Is my data secure when using this HTML entity encoder?","answer":"Yes! All encoding and decoding happens 100% in your browser using JavaScript. Your HTML content never leaves your device or gets sent to any server, making it safe for encoding sensitive content and testing XSS prevention."}],"keywords":["html","entities","encoder","decoder","escape","xss","html encode","html decode","special characters","security"],"url":"/tools/html-entities"}

HTML Entity Encoder/Decoder

simple

Encode and decode HTML entities for safe display and XSS prevention. Convert special characters to named entities (&) or numeric entities (&). Essential for displaying code snippets and user input safely.

Encoders & Decodershtmlentitiesencoderdecoder

100% Private - Runs Locally

How to Use

1Choose Encode or Decode mode
2Enable "Encode All" for special characters
3Paste your HTML or text
4Copy the encoded/decoded result

Examples

Encode HTML Tags

Input

<div class="container">Hello & Welcome!</div>

Output

&lt;div class=&quot;container&quot;&gt;Hello &amp; Welcome!&lt;/div&gt;

Encode Special Symbols

Input

Price: €50 © 2024 Company™

Output

Price: &euro;50 &copy; 2024 Company&trade;

Decode Entities

Input

&lt;script&gt;alert(&#39;XSS&#39;)&lt;/script&gt;

Output

<script>alert('XSS')</script>

Frequently Asked Questions

Related Tools

View all

URL Encoder/Decoder

Encode and decode URLs and URL components with percent-encoding. Convert special characters, Unicode, and query parameters to URL-safe format. Supports both full URL and component encoding modes.

Base64 Encoder/Decoder

Encode and decode Base64 data instantly. Convert text, files, and images to Base64 format for embedding in HTML, CSS, JSON, and APIs. Supports URL-safe Base64 and handles Unicode characters.

Markdown to HTML

Convert Markdown to clean, semantic HTML with live preview. Transform README files, documentation, blog posts, and notes into web-ready HTML with syntax highlighting, tables, and GFM support.