HTML Entity Encoder/Decoder

Convert special characters to and from HTML entities.

Overview

Converts reserved HTML characters into named entity references (&, <, >) and decimal/hex character codes to prevent XSS attacks and rendering bugs.

Formula & Calculation Method

HTML_Entities = Replace_Characters({ '<': '<', '>': '>', '&': '&', '"': '"', "'": ''' })

Ensures reserved markup delimiters are rendered literally by web browsers rather than executed as DOM markup.

Worked Example: Escaping Script Tag String

Inputs: Raw String: '<script>alert("XSS");</script>'

Replace '<' with '<'.
Replace '>' with '>'.
Replace '"' with '"'.
Result: '<script>alert("XSS");</script>'

Summary: Escaped HTML Entities | XSS Injection Prevented | Browser Displays Literal Text

Common Use Cases

XSS Sanitization: Escape untrusted user comments before rendering them into dynamic web pages.
Code Block Display: Render literal HTML tags inside <code> and <pre> elements on technical blogs.
Special Symbol Rendering: Display copyright symbols (©), currency symbols (£, ¥), and math characters.

Frequently Asked Questions

Why must the ampersand (&) always be escaped first?

Because HTML entities begin with an ampersand; if you escape other characters first and then escape ampersands, you double-escape all previous entities.

What are the 5 critical HTML entities to escape?

& (&), < (<), > (>), " ("), and ' (' or ').

What is the difference between named entities and numeric entities?

Related Calculators & Tools

JSON Formatter - Pretty-print, minify and validate JSON.
Base64 Encoder/Decoder - Encode text to Base64 or decode it back.
Color Picker - Pick a color and read off HEX, RGB and HSL instantly.
Regex Tester - Test a regular expression against sample text with live match highlighting.
HTML Formatter - Indent and clean up messy HTML markup.
SQL Formatter - Readable indentation for SQL queries.