Text ToolsFree

HTML Entity Encoder

Encode special HTML characters (&, <, >, ", ') into their HTML entity equivalents for safe HTML output, or decode HTML entities back to readable text. Essential for preventing XSS attacks and safely rendering user-generated content. No signup.

Frequently Asked Questions

Why do I need to encode HTML entities?▼
HTML characters like <, >, &, and " have special meaning in HTML markup. If you insert user-generated text directly into HTML without encoding, an attacker can inject HTML tags or scripts (XSS attacks). Encoding converts < to &lt; so the browser displays it as text, not interprets it as a tag.
Which characters are encoded?▼
The five core HTML entities: & (ampersand) → &amp;, < (less-than) → &lt;, > (greater-than) → &gt;, " (double quote) → &quot;, and ' (single quote) → &#x27;. These cover all XSS injection vectors in HTML attributes and content.
When should I encode vs decode?▼
Encode when inserting text into HTML output (templates, user content, emails). Decode when you receive HTML-encoded text and need to display or process the original characters — for example, when parsing HTML-encoded API responses.
Does this encode all Unicode characters?▼
The tool encodes the five critical HTML characters. Extended HTML entities (like &nbsp;, &eacute;, etc.) can be decoded. Full Unicode-to-entity conversion is available as an option.
Is the encoding done in the browser?▼
Yes. All HTML entity encoding and decoding happens locally in your browser with JavaScript. No text is submitted to any server.