HTML Entity Encoder / Decoder

About HTML entities

Five characters have special meaning in HTML — &, <, >, " and ' — and must be escaped as entities when you want them displayed literally. Forgetting to escape user-supplied text is the root cause of cross-site scripting (XSS), which makes this the single most security-relevant encoding on the web.

Frequently asked questions

Which characters does "Encode" escape?

The five HTML-special characters, always. With the non-ASCII option enabled it also converts accented letters, symbols and emoji to numeric entities (&#…;) — useful for HTML files that might be saved in a non-UTF-8 encoding.

What's the difference between é and é?

They render identically (é). Numeric entities work for every Unicode character; named entities exist only for a few hundred common ones. The decoder here understands both.

Is escaping enough to prevent XSS?

For text placed in element content or quoted attributes, yes. Other contexts (URLs, JavaScript, CSS) need their own context-specific encoding — see the OWASP XSS prevention cheat sheet.