HTML entities are special codes that let you display characters like <, >, and & on a page without the browser treating them as markup. If you want to show a literal angle bracket or print a code snippet inside a paragraph, you need to encode it first. Here is how entities work and how to do the encoding safely.
What HTML entities are
An HTML entity is a placeholder for a character the browser would otherwise misread. There are two forms:
- Named entities like
&(&),<(<),>(>), and"(”). - Numeric entities that use the character’s code point, in decimal
©or hexadecimal©, both of which render as the copyright symbol.
Named entities are easier to read, but they only exist for a limited set of characters. Numeric entities work for any character, including symbols and emoji, which makes them the reliable fallback when no named form exists.
The five characters that matter most
Most of the time you only need to worry about five characters that have special meaning in HTML:
&becomes&<becomes<>becomes>"becomes"'becomes'(or')
One rule is non-negotiable: encode the ampersand first. If you replace < with < before escaping &, you will double-encode and corrupt your output. Always turn & into &, then handle the rest.
Why encoding prevents XSS
When you drop untrusted text straight into a page, a <script> tag inside it runs. That is cross-site scripting (XSS). Encoding the special characters turns <script> into harmless visible text (<script>), so the browser displays it instead of executing it. Encode user-generated content, anything pulled from a URL or form field, and any value you did not write yourself. The character set you escape depends on context: the five above cover ordinary HTML body and attribute output.
You should encode in three common situations: displaying code or markup as text, printing special symbols like © or →, and rendering any user-generated content.
How to encode and decode
Use the HTML Entity Encoder to convert in either direction:
- Open the HTML Entity Encoder and paste your text.
- Choose Encode to turn raw characters into entities, or Decode to turn entities back into readable characters.
- Copy the result into your HTML, template, or content field.
It runs entirely in your browser, so your text never leaves your device.
Related tools
- URL Encode / Decode: escape characters for safe use in query strings and links.
- Base64 Encode / Decode: encode binary or text data for transport.
- Markdown to HTML: convert Markdown into clean HTML markup.
Encode the ampersand first, escape the five safety-critical characters, and untrusted text becomes text instead of a security hole.