0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0
Configuration
Encode and decode HTML entities. Essential encodes only the 5 characters that break HTML: & < > " '. Extended encodes all non-ASCII characters as well. Choose between named entities (&amp;), decimal (&#38;) or hexadecimal (&#x26;).
Operation
Reach
Format
0

How it works

HTML entities represent characters that have special meaning in markup (< > & " ') or that are not ASCII, using sequences like &lt;, &amp;, or &#169;. This way the browser shows them as text instead of interpreting them as code.

There are three equivalent formats: named (&copy;), decimal (&#169;), and hexadecimal (&#xA9;). All three produce the same character; the named one is more readable but only exists for a known set.

The "essential" scope escapes only the characters that break HTML (& < > " '); the "all" scope also escapes any non-ASCII character.

Examples

<a href="#">&lt;a href=&quot;#&quot;&gt;Escaping prevents the browser from interpreting the tags and shows them as text.
5 < 10 & 3 > 15 &lt; 10 &amp; 3 &gt; 1
© 2024 · €&copy; 2024 · &euro;With "all" scope and named format. In decimal they would be &#169; and &#8364;; in hexadecimal, &#xA9; and &#x20AC;.

Use cases

  • Show HTML code as text on a page (examples, documentation) without it being rendered.
  • Escape user input before inserting it into HTML to prevent XSS.
  • Insert special symbols (©, €, →, ½) portably across encodings.
  • Decode text with entities copied from a page's source code.

Frequently asked questions

Which format is best: named, decimal, or hexadecimal?

The named one (&copy;) is the most readable, but only covers characters with a defined name. The decimal (&#169;) and hexadecimal (&#xA9;) work for any Unicode character, so they are the safe option for uncommon symbols.

Does encoding entities prevent XSS attacks?

It is an important part, but escaping must be done according to the context (HTML content, attribute, JavaScript, or URL). Do not rely on a single layer: also use the framework's protections.

Which characters must always be escaped?

& < and > in content, and additionally " and ' inside attribute values. The "essential" scope covers exactly that set.

Is my text sent to a server?

No. The encoding and decoding happen entirely in your browser.

See also