Guide

How HTML Entities Work (and When to Encode or Decode)

Learn what HTML entities are, why encoding prevents bugs and XSS, and how to convert between text and entities.

An HTML entity encoder converts characters like <, >, &, and quotes into their entity form (&lt;, &gt;, &amp;, &quot;) so they display as text instead of being interpreted as markup. A decoder reverses the process.

What HTML entities are

HTML entities are escape sequences that represent characters that are either reserved in HTML (like < and >) or hard to type (like © or é). They take the form &name; or &#number;. Browsers render them as the character they name.

Why encoding matters

If you display user input that contains <script> tags without encoding, the browser runs the script — a classic cross-site scripting (XSS) vulnerability. Encoding < and > as &lt; and &gt; makes the tags display as harmless text. Encoding is the first line of defence when showing untrusted content.

How to use an encoder/decoder

  1. To encode: paste text containing special characters and copy the entity-encoded output.
  2. To decode: paste text with entities and copy the plain-text result.
  3. Use encoding before displaying user content; use decoding when importing legacy content.

Examples

The text "a < b && b > c" encodes to "a &lt; b &amp;&amp; b &gt; c" so it renders correctly in HTML. The entity "&copy; 2024" decodes to "© 2024".

When an entity encoder/decoder is useful

  • Safely displaying user-submitted text on a web page.
  • Showing code snippets that contain HTML tags.
  • Converting legacy entity-laden text back to readable characters.
  • Inserting special symbols like ©, ™, or em dashes.

Put it into practice

Use the HTML Entity Encoder / Decoder right now — free, in your browser, no sign-up required.

Try the HTML Entity Encoder / Decoder