HTML Entities Encoder & Decoder Online — Convert Special Characters Free

What Are HTML Entities?

HTML entities are special sequences that represent characters which either have special meaning in HTML markup or cannot be directly typed. An entity begins with an ampersand (&) and ends with a semicolon (;). There are two forms:

• Named entities: use a descriptive name, e.g., & for &, < for <, > for >.
• Numeric entities: use the character's Unicode code point, e.g., < (decimal) or < (hex) for <.

The five characters that must always be encoded in HTML are: & (ampersand), < (less-than), > (greater-than), " (double quote), and ' (single quote / apostrophe).

How to Encode/Decode HTML Entities Online

1. Open the HTML entities tool at DevKits.
2. To encode: paste raw text containing special characters into the input, get entity-encoded HTML output.
3. To decode: paste HTML with entity sequences, get the original readable text back.
4. Choose encoding level: encode only the five mandatory characters, or encode all non-ASCII characters as entities.
5. Copy the result to your clipboard.

Example

Raw text:    <script>alert("XSS")</script>
Encoded:     &lt;script&gt;alert(&quot;XSS&quot;)&lt;/script&gt;

Encoded:     Tom &amp; Jerry &mdash; a classic
Decoded:     Tom & Jerry — a classic

Key Features

• Bidirectional — encode raw text to entities or decode entities to text.
• Named and numeric entities — output in named format (&) or numeric (&).
• Encoding level control — encode only required characters or all non-ASCII characters.
• XSS prevention helper — highlights characters that could enable cross-site scripting if not encoded.
• Entity reference table — quick lookup for common named entities.

Use Cases

Preventing Cross-Site Scripting (XSS)

XSS is one of the most common web security vulnerabilities. It occurs when user-supplied content is rendered as HTML without proper encoding. Encoding user input converts <script> into <script>, which displays as text rather than executing as code. An HTML entity encoder is the first step in output escaping.

Displaying Code Snippets

When showing HTML code examples in a web page or blog post (like this one), the code must be HTML-entity-encoded to display correctly rather than being interpreted as actual markup. An HTML encoder makes this trivial.

Email Templates

HTML emails often need entity-encoded special characters to render consistently across email clients. Characters like em dashes, curly quotes, and copyright symbols are more reliably displayed as named or numeric entities than as raw UTF-8 characters in older email clients.

CMS and Template Systems

Content management systems sometimes store data with HTML entities and display decoded text. When extracting content from a CMS for processing, decoding entities restores the original text. When inserting content, encoding ensures safe storage.

Debugging Garbled HTML

Double-encoded HTML (entities encoded twice: <) is a common source of display bugs. An HTML decoder quickly reveals whether an entity has been encoded once or multiple times.

Common HTML Entity Reference

&amp;   = &    &lt;    = <    &gt;    = >
&quot;  = "    &apos;  = '    &nbsp;  = (non-breaking space)
&copy;  = ©    &reg;   = ®    &trade; = ™
&mdash; = —    &ndash; = –    &hellip;= …
&euro;  = €    &pound; = £    &yen;   = ¥

Frequently Asked Questions

Do I need to encode all characters as HTML entities?

No. For modern UTF-8 encoded web pages, only the five critical characters (&, <, >, ", ') strictly need encoding. Non-ASCII characters like accented letters and emoji can be included directly in UTF-8 HTML without entity encoding.

What is the &nbsp; entity used for?

  is a non-breaking space — a space character that prevents line breaks at that position and doesn't collapse with adjacent whitespace like regular spaces do. It's used for formatting in tables, typographic spacing, and preventing awkward line breaks.

What's the difference between named and numeric entities?

Named entities (&) are defined in the HTML specification and are more readable. Numeric entities (& decimal or & hex) work for any Unicode character and don't require browser support for specific named entities.

Can HTML entity encoding prevent all XSS attacks?

HTML entity encoding prevents XSS in HTML contexts (element content and attribute values). However, you also need context-specific encoding: JavaScript encoding for JS contexts, URL encoding for URL contexts, and CSS encoding for CSS contexts. No single encoding covers all XSS vectors.

Is the tool free?

Yes, completely free with no account or signup required. Your text is processed locally in the browser.