Encode text into safe HTML entities or decode entities back into readable text. Named, decimal, and hex formats, plus attribute-safe and XSS-safe modes.
Encode / Decode HTML
Entity Reference (common entities)
| Character | Named | Decimal | Hex |
|---|
What Is HTML Encoding?
HTML encoding converts characters that have special meaning in HTML, such as less-than, greater-than, ampersand, and quotes, into entity references so browsers display them as literal text instead of interpreting them as markup. Decoding reverses the process.
This matters most when displaying user-submitted content. Without encoding, a comment containing <script> could execute as real JavaScript in every visitor's browser, a class of vulnerability called cross-site scripting (XSS). Encoding the five reserved characters, less-than, greater-than, ampersand, double quote, and single quote, neutralises that risk for plain text content.
Choosing the Right Encoding Mode
Minimal encodes only the five characters that are always unsafe in HTML text. Full also converts every non-ASCII character to a numeric entity, useful for maximum compatibility with older systems or unknown character encodings. Attribute-safe adds extra encoding needed specifically inside HTML attribute values. JS-string safe escapes characters so the text can sit safely inside a JavaScript string literal embedded in HTML.
Named vs Decimal vs Hex Entities
All three formats represent the same character. & (named), & (decimal), and & (hex) all render as an ampersand. Named entities are the most human-readable and are supported for common characters. Decimal and hex numeric entities work for any Unicode code point, including characters that have no named entity, which makes them the safer default for full non-ASCII encoding.