What are HTML Entities?
HTML entities are special strings that represent characters which have reserved meaning in HTML or which cannot be easily typed on a keyboard. Every entity starts with an ampersand (&) and ends with a semicolon (;). The five most important entities are & (&), < (<), > (>), " ("), and ' (').
Entities come in two forms: named entities like © for the copyright symbol, and numeric entities like © (decimal) or © (hexadecimal) for the same character. Numeric entities can represent any Unicode character, while named entities only exist for a defined set of common characters.
Why HTML Encoding Matters
HTML encoding is critical for both correctness and security. Characters like <, >, and & are part of HTML syntax. If these characters appear in text content without encoding, the browser may misinterpret them as HTML markup, breaking the page layout or, worse, creating security vulnerabilities.
The most serious risk is Cross-Site Scripting (XSS). When user-supplied text is inserted into a page without encoding, an attacker can inject malicious <script> tags that execute in other users' browsers. HTML encoding neutralizes this attack by converting special characters to their entity equivalents, which the browser renders as text rather than executing as code.
How to Use This Tool
- Paste raw HTML or text with special characters into the input panel.
- Click Encode to convert special characters to HTML entities, or Decode to convert entities back to their original characters.
- Click Copy to copy the result to your clipboard.
- Use the reference table below the tool for quick lookup of common entities.
Frequently Asked Questions
What is an HTML entity?
An HTML entity is a string that represents a special character in HTML. Entities begin with an ampersand (&) and end with a semicolon (;). For example, < represents the less-than sign, & represents the ampersand, and represents a non-breaking space. Entities allow you to display characters that would otherwise be interpreted as HTML markup.
Why do I need to encode HTML?
HTML encoding is essential for correctness and security. Characters like <, >, and & have special meaning in HTML. If user-supplied text containing these characters is inserted into a page unencoded, the browser may interpret them as tags. This is also the primary vector for XSS attacks, where attackers inject malicious scripts through unencoded input.
What is &?
& is the HTML entity for the ampersand character (&). Because the ampersand marks the start of an entity reference in HTML, a literal ampersand must be encoded as & to prevent the browser from interpreting it as the beginning of an entity. This is one of the five characters that must always be encoded.
What is XSS?
XSS (Cross-Site Scripting) is a security vulnerability where an attacker injects malicious scripts into web pages viewed by other users. The most common cause is inserting user input into HTML without proper encoding. HTML encoding prevents this by converting < and > to their entity equivalents, which the browser renders as text rather than executing as code.
What's the difference between named and numeric entities?
Named entities use descriptive names like < and ©. Numeric entities use the character's Unicode code point: < and ©. Named entities are more readable, but not every character has a named entity. Numeric entities can represent any Unicode character.
When should I HTML encode text?
Always encode text when inserting it into HTML element content or attribute values, especially when the text comes from user input, URL parameters, or any external source. Most modern frameworks (React, Angular, Vue, Django, Rails) encode output by default. Manual encoding is needed in vanilla JavaScript when using innerHTML or building HTML strings.