HTML Entity Encoder
Encode HTML special characters.
Input
Result
What is an HTML Entity Encoder?
An HTML Entity Encoder is a free online tool that encodes special HTML characters (like <, >, &, ") into their corresponding HTML entities (<, >, &, ") and decodes them back. It is essential for preventing XSS attacks and displaying HTML code as text on web pages.
How to encode HTML entities manually
Replace each special character with its corresponding HTML entity: & (ampersand) becomes &, < (less-than) becomes <, > (greater-than) becomes >, " (double quote) becomes ", and ' (apostrophe) becomes '. Always encode the ampersand first to avoid double-encoding.
Example calculation
Input:
Common mistakes
- Encoding the ampersand last — Always encode & first, otherwise existing entities like < will be double-encoded to <.
- Using encoded entities in non-HTML contexts — HTML entities only work in HTML. In plain text, they will appear literally as < rather than as <.
- Forgetting to encode attribute values — Attribute values in HTML tags also need encoding. A double quote inside an attribute value must be encoded as ".
Frequently asked questions
What is an HTML Entity Encoder?
An HTML Entity Encoder is a tool that encodes special HTML characters into their corresponding HTML entities and decodes HTML entities back to regular characters.
Which characters need HTML encoding?
The main characters that need encoding are < (<), > (>), & (&), " ("), and ' ('). These have special meaning in HTML and must be escaped.
How do I encode a less-than symbol in HTML?
Use the entity < to encode the less-than symbol (<). This prevents the browser from interpreting it as the start of an HTML tag.
What is the difference between encoding and decoding?
Encoding converts special characters to HTML entities (e.g., < becomes <). Decoding does the reverse, converting entities back to characters (e.g., < becomes <).
Why are HTML entities important for security?
HTML entity encoding prevents cross-site scripting (XSS) attacks by ensuring user-supplied content is displayed as text rather than executed as HTML or JavaScript.