HTML Entity Encoder
Encode or decode HTML entities like & and ©.
Frequently asked questions
What are HTML entities?
HTML entities are codes like & for &, < for < and © for ©. They let you display characters that would otherwise be interpreted as HTML or are hard to type.
When should I encode HTML entities?
Whenever you put untrusted or special text into an HTML page, encoding prevents it from breaking the markup or enabling cross-site scripting.
Does it handle Unicode characters?
Yes. It can encode non-ASCII characters to numeric entities and decode both named and numeric entities back to their characters.
What is the difference between named and numeric HTML entities?
Named entities use a keyword such as ampersand-amp-semicolon, while numeric entities use a code point like ampersand-hash-38-semicolon in decimal or hexadecimal. Numeric entities can represent any character, whereas named ones cover a fixed set.
Which characters must always be escaped in HTML?
The ampersand, less-than and greater-than signs must be escaped in text content, and inside attribute values the relevant quote character too, otherwise the browser may misinterpret them as markup.
Does encoding HTML entities prevent cross-site scripting?
Encoding untrusted text before placing it in HTML is a core defense against cross-site scripting, but the correct encoding depends on context, such as HTML body, attribute, URL or script, so use the right one for each place.
What is the difference between HTML entity encoding and URL encoding?
HTML entity encoding makes text safe inside HTML markup, while URL encoding makes text safe inside a web address. They use different rules and are not interchangeable.