What are HTML Entities?
HTML uses certain characters as part of its syntax — angle brackets (< and >), ampersands (&), and quotes are all special in HTML. If you want these characters to appear as visible text on a web page rather than being interpreted as HTML code, they need to be encoded as HTML entities.
For example, < becomes <, > becomes >, and & becomes &. There are also entities for characters that aren’t on a standard keyboard, like copyright symbols (©), em dashes (—), and non-breaking spaces ( ).
What Does This Tool Do?
This tool encodes text into HTML entities (replacing special characters with their entity equivalents) and decodes HTML entities back to plain text. It handles both named entities and numeric character references.
How to Use This Tool
- Choose Encode or Decode mode.
- Paste or type your text in the input area.
- The result appears immediately.
- Use the copy button to grab the output.
Common Use Cases
- Escaping user input: Encode user-submitted text before inserting it into HTML to prevent cross-site scripting (XSS) vulnerabilities.
- Displaying code: Show HTML markup as visible text on a page without the browser rendering it.
- Decoding emails: Email clients sometimes use HTML entity encoding — decode to read the plain text.
- Working with CMS content: Some content management systems encode special characters in stored content.
Entity Reference Table
The entities you’ll actually use, grouped by purpose:
| Character | Named | Numeric | Notes |
|---|---|---|---|
< | < | < | must be escaped in content |
> | > | > | |
& | & | & | must be escaped everywhere |
" | " | " | required inside double-quoted attributes |
' | ' | ' | ' is not valid in old HTML4 — prefer ' |
| non-breaking space | |   | keeps words together across line breaks |
| © | © | © | |
| ® | ® | ® | |
| ™ | ™ | ™ | |
| — (em dash) | — | — | |
| – (en dash) | – | – | |
| … | … | … | |
| € | € | € | |
| → | → | → | |
| ✓ | ✓ | ✓ |
Do You Still Need Entities in 2026?
Less than you’d think. Modern pages declare <meta charset="utf-8">, so you can type ©, —, or € directly into your HTML — no entity required. Only three cases genuinely require entities today:
- The syntax characters
<,>,&(and quotes inside attributes) — these always need escaping because they mean something to the parser. - Invisible or ambiguous characters —
, zero-width spaces, soft hyphens — where a literal character would be indistinguishable from a regular space in your editor. - Content that passes through encoding-hostile systems — old email clients, misconfigured databases, or templates saved in Latin-1.
If you’re escaping user input to prevent XSS, entity-encode < > & " ' at minimum — that neutralizes tag injection and attribute breakout.
Frequently Asked Questions
What's the difference between named and numeric entities?
Named entities like < are human-readable. Numeric entities like < or < (hex) represent the same character by its Unicode code point. Both are valid HTML.
Does this protect against XSS attacks?
Encoding user input as HTML entities is an important step in preventing XSS. However, proper security requires a complete approach — use server-side sanitization libraries, not just this tool.
Is my data private?
Yes. All encoding and decoding runs locally in your browser.
Why do I see &amp; in my content?
That’s double encoding — the & of an already-encoded & was encoded again. It usually means two layers of your stack both escape output. Decode here repeatedly until the text stops changing to see the original, then fix the duplicate escaping step.
Should I encode entities in JSON or JavaScript strings?
No — HTML entities are only meaningful inside HTML. JSON uses backslash escapes (\n, é), and JavaScript strings likewise. Encoding < into a JSON value just puts the literal five characters < in your data.