HTML Entity Encoder
Escape and unescape HTML entities to display markup safely.
Escaped output
The converted value appears here.
Common entities
| & | & | Ampersand |
| < | < | Less than |
| > | > | Greater than |
| " | " | Double quote |
| | Non-breaking space | |
| © | © | Copyright |
| — | — | Em dash |
| € | € | Euro sign |
About HTML Entity Encoder
Any time user-supplied text is placed into an HTML document, characters that mean something to the parser have to be replaced with entity references - otherwise a stray angle bracket ends your paragraph and a quote breaks out of an attribute.
This encoder converts text to safe entities and decodes entity-laden markup back to readable text, which is equally useful for pasting code samples into a blog post.
Frequently asked questions
Which characters are escaped?
In basic mode, the five characters that matter for markup safety: ampersand, less-than, greater-than, double quote and apostrophe. Full mode also escapes every non-ASCII character as a numeric entity.
Is escaping enough to prevent XSS?
HTML-escaping untrusted text before inserting it into markup prevents the most common injection, but attribute and script contexts need their own escaping rules.
Can it decode named entities?
Yes. Named entities, plus decimal and hexadecimal numeric references, are all decoded.