Stax

HTML Entity Encoder / Decoder

Encode HTML special characters to entities or decode entities.

Common HTML entities reference
CharEntityCharEntity
&&amp;<&lt;
>&gt;"&quot;
'&#39; &nbsp;
©&copy;®&reg;
™&trade;€&euro;
£&pound;¥&yen;
¢&cent;§&sect;
°&deg;±&plusmn;
×&times;÷&divide;
¼&frac14;½&frac12;
¾&frac34;–&ndash;
—&mdash;‘&lsquo;
’&rsquo;“&ldquo;
”&rdquo;•&bull;
…&hellip;←&larr;
→&rarr;↑&uarr;
↓&darr;↔&harr;
♠&spades;♣&clubs;
♥&hearts;♦&diams;

The 5 essential HTML characters to always encode

Any text that will be rendered as HTML content must have these five characters escaped to prevent parsing issues and XSS attacks:

  • & (ampersand) → &amp;
  • < (less than) → &lt;
  • > (greater than) → &gt;
  • " (double quote) → &quot;
  • ' (single quote) → &#39;

Three encoding modes explained

  • Minimal: Only encodes the 5 HTML-special characters above. Use when rendering user content in HTML to prevent XSS.
  • Named entities: Converts named characters (©, ®, €, →, etc.) to their HTML entity equivalents. Useful for typographically correct HTML.
  • Numeric: Encodes all non-ASCII characters as decimal character references (&#xx;). Use when targeting strict ASCII-only HTML documents.

Decoding HTML entities

Switch to Decode mode to convert HTML entities back to readable characters. Useful for reading HTML source code, inspecting encoded email bodies, or processing HTML-encoded data from APIs.

Frequently asked questions

What are HTML entities?
HTML entities are special codes used to represent characters that either have special meaning in HTML or cannot be typed easily. They start with an ampersand (&) and end with a semicolon (;). For example, &lt; represents < (which would otherwise start an HTML tag) and &amp; represents & (which would otherwise start an entity).
When do I need to encode HTML characters?
Encode HTML characters when: (1) displaying user-submitted content in HTML to prevent XSS (Cross-Site Scripting) attacks — any < > & " ' must be encoded, (2) including special symbols like copyright ©, registered ®, or currency signs in HTML, (3) placing HTML code examples inside a web page for display.
What is the difference between named and numeric entities?
Named entities use a descriptive name: &lt; for <, &copy; for ©. Numeric entities use the character's decimal (&#60;) or hex (&#x3C;) Unicode code point. Named entities are more readable; numeric entities work for any character, even those without a named equivalent. All browsers support both.
What is XSS and how does encoding prevent it?
Cross-Site Scripting (XSS) is an attack where malicious JavaScript is injected into a web page via unescaped user input. If a user submits <script>alert(1)</script> and it is rendered as HTML, the script executes. Encoding the < and > as &lt; and &gt; makes the browser display the text literally instead of executing it as HTML.
What is the minimal encoding level?
Minimal encoding only escapes the 5 characters with special meaning in HTML: & (→ &amp;), < (→ &lt;), > (→ &gt;), " (→ &quot;), and ' (→ &#39;). This is the minimum required to safely embed text in HTML and prevent XSS. Use this level when you need to display user input in an HTML page.

Related tools