HTML Entity Encoder / Decoder
Convert special characters to HTML entities for XSS prevention, or decode HTML entities back to readable text.
How to Use the HTML Entity Encoder / Decoder
- Paste or type the text containing special characters or HTML entities into the input field.
- Select Encode to convert characters like <, >, &, and quotes into HTML entities, or Decode to reverse.
- Review the output which is generated instantly in your browser.
- Copy the result and use it safely in your HTML code.
What are HTML Entities and Why Do They Matter?
HTML entities are special codes used to represent characters that have reserved meaning in HTML or that cannot be easily typed. For example, the less-than sign < is represented as < and the ampersand & becomes &. Named entities like © (copyright symbol) and numeric entities like © both serve this purpose. HTML entity encoding is one of the fundamental defenses against Cross-Site Scripting (XSS) attacks. When user-supplied input is reflected in an HTML page without proper encoding, an attacker can inject malicious script tags or event handlers. By encoding characters like <, >, ", ', and & before rendering them in HTML, you prevent the browser from interpreting user data as executable code. However, context matters. HTML entity encoding alone is not sufficient for all contexts. Data placed inside JavaScript blocks, CSS properties, URL attributes, or unquoted HTML attributes requires different encoding strategies. The OWASP XSS Prevention Cheat Sheet recommends applying output encoding specific to the context where data is rendered. For HTML body content, HTML entity encoding is the correct defense. For other contexts, use the appropriate encoding function for that specific output context.
Frequently Asked Questions
When user input is encoded before being placed in HTML, characters like < and > are converted to < and >. This prevents the browser from interpreting the input as HTML tags or script elements. For example, an injected <script>alert(1)</script> becomes harmless text instead of executable code.
No. HTML entity encoding only protects against XSS in the HTML body context. If user data is placed inside JavaScript, CSS, URL attributes, or unquoted attributes, you need context-specific encoding. OWASP recommends different encoding rules for each output context to achieve comprehensive XSS prevention.
Named entities use a descriptive label like & or <, while numeric entities use the Unicode code point like & or <. Both produce the same result. Named entities are more readable, but not every character has a named entity. Numeric entities (especially hex format like <) can represent any Unicode character.