Should I use named or numeric entities?

Named entities (©, é) are self-documenting and easier to review in source code, so prefer them for hand-maintained HTML. Numeric references (©) work everywhere - including XML, RSS, and SVG, where the HTML named set is not defined - so prefer numeric when your output feeds anything stricter than a browser. If your pages are served as UTF-8 (they should be), you can also just use the literal characters and only escape the five specials.

Why does break my XML or RSS feed?

XML predefines only five entities: & < > " and '. Every other HTML name - , ©, — - is undefined in XML, so a conforming parser throws an "undefined entity" error the moment it hits one. Encode with numeric mode instead: is the same non-breaking space and is valid in both HTML and XML.

What is the difference between é and é?

Nothing except the number base - both are character references for é (U+00E9). é uses decimal, é uses hexadecimal (the x prefix, case-insensitive). Hex form maps directly onto Unicode code point notation, which is why tooling often emits it; browsers treat the two identically. The decoder here accepts both.

Why do I see < instead of < in my output?

That is double encoding: the string was escaped twice, so the & of < got re-escaped into &. It typically happens when both your template engine and your own code escape the same value, or when already-encoded content is saved to a database and escaped again on render. Decode twice with the swap button to recover the original, then make sure escaping happens exactly once - at output time, not at storage time.

Why does this tool not use document.createElement to decode?

The common textarea/innerHTML trick only works in a browser, behaves inconsistently across engines, and - if you use innerHTML on a div rather than a textarea - can actually execute markup, turning your decoder into an XSS vector. This implementation is a pure string transform with an explicit entity table, so it runs in Node, Tauri, and web workers, and can never execute anything.

Is ' safe to use for single quotes?

Mostly, with a caveat: ' is predefined in XML and HTML5, but it was never part of HTML 4.01, so ancient renderers and some strict email clients do not recognize it. The numeric form ' is understood everywhere, which is why this tool emits ' when encoding single quotes while still accepting ' when decoding.

Do I need to encode accented characters like é or ü at all?

Not if your document is served as UTF-8 with the correct charset declaration - literal é in the source is perfectly valid and more readable. Entity-encode accents when you cannot control the transport encoding: legacy systems that mangle bytes, email templates passing through unknown gateways, or copy destined for a CMS that re-encodes on save. When in doubt, named mode keeps them safe without hurting readability much.

How are emoji handled?

Emoji live outside the Basic Multilingual Plane, and JavaScript stores them as surrogate pairs. Naive per-code-unit encoders emit two broken references like &#55357;&#56832;. This tool iterates by code point, so 😀 encodes as the single valid reference 😀, and decoding a reference above U+FFFF correctly reconstructs the pair via String.fromCodePoint.

What does do, and when should I use it?

It is a non-breaking space (U+00A0): it renders like a normal space but the browser will not wrap the line at it, and consecutive ones are not collapsed. Use it to keep pairs together - 10 kg, Fig. 3, a name and its initial. Do not use runs of them for layout spacing; that is what CSS margin and padding are for, and screen readers announce the extra characters.

How do I decode HTML entities in JavaScript or Python?

In Python the standard library covers it: html.unescape(s) resolves named, decimal, and hex references. In Node, use a library such as he (he.decode(s)) or entities. In the browser, avoid the innerHTML trick on a div - it can execute markup; if you must use the DOM, parse into a textarea value or use DOMParser instead.

Does encoding entities protect against SQL injection too?

No. HTML entity encoding is output escaping for one specific context: HTML documents. SQL injection is prevented with parameterized queries, URL injection with percent-encoding, and shell injection with proper argument passing. Encoding user input into entities before storing it in a database is actually an anti-pattern - store raw text, and escape at render time for whichever context you are rendering into.

HTML Entity Encoder/Decoder

Q: Why do I see &lt; instead of < in my output?

That is double encoding: the string was escaped twice, so the & of < got re-escaped into &. It typically happens when both your template engine and your own code escape the same value, or when already-encoded content is saved to a database and escaped again on render. Decode twice with the swap button to recover the original, then make sure escaping happens exactly once - at output time, not at storage time.

Q: Why does this tool not use document.createElement to decode?

The common textarea/innerHTML trick only works in a browser, behaves inconsistently across engines, and - if you use innerHTML on a div rather than a textarea - can actually execute markup, turning your decoder into an XSS vector. This implementation is a pure string transform with an explicit entity table, so it runs in Node, Tauri, and web workers, and can never execute anything.

Q: Is ' safe to use for single quotes?

Mostly, with a caveat: ' is predefined in XML and HTML5, but it was never part of HTML 4.01, so ancient renderers and some strict email clients do not recognize it. The numeric form ' is understood everywhere, which is why this tool emits ' when encoding single quotes while still accepting ' when decoding.

Q: Do I need to encode accented characters like é or ü at all?

Not if your document is served as UTF-8 with the correct charset declaration - literal é in the source is perfectly valid and more readable. Entity-encode accents when you cannot control the transport encoding: legacy systems that mangle bytes, email templates passing through unknown gateways, or copy destined for a CMS that re-encodes on save. When in doubt, named mode keeps them safe without hurting readability much.

Q: How are emoji handled?

Emoji live outside the Basic Multilingual Plane, and JavaScript stores them as surrogate pairs. Naive per-code-unit encoders emit two broken references like &#55357;&#56832;. This tool iterates by code point, so 😀 encodes as the single valid reference 😀, and decoding a reference above U+FFFF correctly reconstructs the pair via String.fromCodePoint.

Q: What does do, and when should I use it?

It is a non-breaking space (U+00A0): it renders like a normal space but the browser will not wrap the line at it, and consecutive ones are not collapsed. Use it to keep pairs together - 10 kg, Fig. 3, a name and its initial. Do not use runs of them for layout spacing; that is what CSS margin and padding are for, and screen readers announce the extra characters.

Encode and decode HTML entities - named (&), decimal (&), and hex (&) forms, with XSS-safe special-character escaping

Mode:

Input0 characters

Output

0 characters

Output will appear here...

Category:encoding

Mode:Offline

Version:1.0.0

Access:Free

What is HTML Entity Encoder/Decoder?

HTML Entity Encoder/Decoder interface on Toolz.dev - Encode and decode HTML entities - named (&), decimal (&), and hex (&) forms, with XSS-safe special-character escaping

HTML Entity Encoder/Decoder converts characters that have special meaning in HTML into safe entity references, and turns entities from any source back into readable text. In HTML, < starts a tag and & starts an entity - so if user-generated content containing <script> lands in your markup unescaped, the browser executes it. Escaping those characters as <script> is the canonical defense against reflected and stored XSS, and this tool performs exactly that transformation using OWASP's recommended minimum set: & < > " and the single quote.

The tool supports three encoding strategies because different contexts need different output. Named mode uses a built-in map of over 100 memorable entities - © for ©, é for é, — for - , … for … - with an automatic numeric fallback (&#NNNN;) for any character without a common name, including emoji. Numeric mode encodes everything as decimal character references, which is what you want for XML or RSS feeds where only five named entities (& < > " ') are defined and   would break the parser. Special-only mode escapes just the five XSS-critical characters, leaving accented text and typography readable in your source - the mode most template engines use by default.

The decoder is equally thorough: it handles named entities, decimal references like é, and hexadecimal references like é - all three forms you will find mixed together in scraped pages, CMS exports, and email HTML. Everything is implemented in pure TypeScript with no DOM tricks (no hidden textarea hack, no document.createElement), which means results are deterministic and the same logic runs identically in your browser, the desktop app, and on the server. Your content never leaves your machine - 100% client-side processing, safe for proprietary copy and user data alike.

How to use HTML Entity Encoder/Decoder?

Paste your text or HTML

Enter raw text you need to make HTML-safe (user input, marketing copy with © and ™, code snippets destined for a <pre> block), or paste entity-riddled HTML like <div class="card"> that you want to read as plain text.

Choose an encoding mode

Named for human-readable output (©, é), Numeric for XML/RSS-safe decimal references (©, é), or Special-only to escape just & < > " ' - the minimum required to prevent XSS while keeping the rest of the text readable.

Encode or decode

Click Encode to convert characters to entities, or Decode to resolve named, decimal ({), and hex () references back to characters. The live character count shows how much the entity expansion grew your string.

Copy or swap

Copy the result to your clipboard, or hit swap to feed the output back as input - useful for peeling apart double-encoded strings like &amp;lt; that went through two escaping layers.

Key Features

100+ named entities

Built-in map covering XSS characters, typography (— … smart quotes), currency (€ £), math symbols, Greek letters, and the full Latin-1 accented alphabet

Three encoding modes

Named for readability, numeric for XML/RSS compatibility, special-only for minimal XSS-safe escaping - pick per context instead of one-size-fits-all

Decodes all three entity forms

Named (&), decimal (&), and hexadecimal (&) references are all recognized, even when mixed in the same document

Pure TypeScript, no DOM

No hidden-element browser hacks - deterministic logic that behaves identically in web, desktop, and server environments

Frequently Asked Questions

At minimum: & < > " and the single quote - that is the OWASP-recommended set for HTML body and attribute contexts, and exactly what the special-only mode encodes. The ampersand must be escaped first (or handled atomically, as this tool does) or you will corrupt already-encoded entities. Note that entity encoding protects HTML contexts only; injecting user data into <script> blocks, URLs, or CSS requires different, context-specific escaping.

Related Tools

CCE

encoding

Caesar Cipher Encoder & Decoder

Encode and decode Caesar cipher text with any shift, plus ROT13 and ROT47. Brute-force all 25 shifts to crack an unknown key.

encoding

Unicode Converter

Convert text to and from Unicode code points, HTML entities, JavaScript escapes, and CSS escapes. Emoji and astral characters handled correctly.

encoding

URL Encoder/Decoder

Encode and decode URLs, query strings, and form data with encodeURIComponent, encodeURI, or form-urlencoded modes

HM&

minify

HTML Minifier & Beautifier

Minify HTML markup for faster page loads or beautify it for readable, indented source

Comments

0 comments

No comments yet. Be the first to share your thoughts!

html entitieshtml encoderhtml decoderhtml escapehtml unescapenamed entitiesnumeric character referencexss escapingspecial charactersampersand encoding

Command Palette

HTML Entity Encoder/Decoder

What is HTML Entity Encoder/Decoder?

How to use HTML Entity Encoder/Decoder?

Paste your text or HTML

Choose an encoding mode

Encode or decode

Copy or swap

Key Features

100+ named entities

Three encoding modes

Decodes all three entity forms

Pure TypeScript, no DOM

Frequently Asked Questions

Related Tools

Caesar Cipher Encoder & Decoder

Unicode Converter

URL Encoder/Decoder

HTML Minifier & Beautifier

Comments