HTML Entity Encoder / Decoder
Encode special characters to & < > or decode them back. Choose named, decimal, or hex format. Full entity reference table included.
Scope
Format
Named vs Decimal vs Hex — At a Glance
Named Entities
& < © €✓Human-readable
✓Shorter for common characters
✓Works in all HTML versions
✗Not every character has a name
✗Must know the entity name
Decimal Numeric
& < © €✓Works for every Unicode character
✓No lookup table needed
✗Less readable than named
✗Slightly longer for common chars
Hex Numeric
& < © €✓Matches Unicode code points directly
✓Familiar to developers
✗Least human-readable
✗Case variations (& vs &)
When to Use HTML Entity Encoding
Preventing XSS
Always encode user-generated content before inserting it into HTML. Encoding < > & " prevents injected scripts from executing.
Displaying Code Samples
When showing HTML or code inside a web page, encode the angle brackets so the browser displays them as text rather than parsing them as tags.
Email Templates
Many email clients only support ASCII. Encoding all non-ASCII characters ensures your email renders correctly across all clients and encodings.
Internationalised Content
Encode accented and special characters (é, ñ, ü) when your HTML file might not be served with UTF-8 encoding declared.
CMS & Rich Text
Legacy CMS platforms may strip or misinterpret special characters. Encoding them first ensures the content is stored and displayed correctly.
XML Documents
XML requires that & < > " be encoded in text nodes and attribute values. HTML entity format is also valid XML entity format for these five characters.
Frequently Asked Questions
What is HTML entity encoding?+
HTML entity encoding replaces characters that have special meaning in HTML — like &, <, >, " — with safe representations called entities. For example & becomes & and < becomes <. This prevents the browser from interpreting those characters as HTML markup and is essential for security and correctness.
What is the difference between named, decimal, and hex entities?+
Named entities use a human-readable name (&, <, ©). Decimal entities use the character's Unicode code point as a decimal number (&, <, ©). Hex entities use the code point in hexadecimal (&, <, ©). All three are equivalent — browsers render them identically.
When should I use 'Encode unsafe only' vs 'Encode all non-ASCII'?+
Use 'Unsafe only' when your HTML file is saved as UTF-8 — the browser can render accented letters and symbols directly, and you only need to escape the five characters that break HTML parsing. Use 'All non-ASCII' for maximum compatibility with older systems or when your output must be pure ASCII, like in email templates or legacy CMS platforms.
Is HTML entity encoding the same as URL encoding?+
No. HTML entity encoding is for embedding text safely inside HTML documents. URL encoding (percent encoding) is for safely including characters in a URL. They use completely different formats — & in HTML vs %26 in a URL. Use our URL Encoder/Decoder tool for URL encoding tasks.
Does encoding HTML entities prevent XSS attacks?+
Encoding HTML entities in user-generated content that you insert into HTML is one of the most important defenses against Cross-Site Scripting (XSS). By encoding <, >, &, ", and ', you prevent injected scripts from being interpreted as markup. However, it must be used in the right context — it does not protect values injected into JavaScript blocks or CSS without additional escaping.
What does &nbsp; do?+
is a non-breaking space. Unlike a regular space, it prevents the browser from collapsing it or wrapping a line at that point. It is commonly used to force spacing in HTML where the browser would otherwise ignore extra spaces, or to keep two words on the same line.
Why does my decoded text look wrong?+
This usually happens when the input contains malformed or non-standard entity references. Make sure entities are properly terminated with a semicolon (;& not &). Also, some old documents use numeric entities from Windows-1252 encoding (like € for €) which decode differently from Unicode code points.
Can I encode an entire HTML file?+
This tool encodes the text content you paste. If you paste raw HTML source code and choose 'Encode unsafe only', it will escape the & < > characters in the markup itself — turning tags into visible text. If you want to embed an existing HTML file as displayable code inside another page, that is exactly the right approach.
More Developer Tools
Free tools for encoding, decoding, and working with web content.
Learn more at MDN: HTML Character References and WHATWG: Named Character References.