HTML Entities Encoder & Decoder — Encode HTML Online
HTML Entities Encoder/Decoder
Encode and decode HTML entities with named, numeric, and hex modes.
Free online HTML entities encoder and decoder supporting named entities (&, <, >, ", '), decimal numeric character references (&), hexadecimal entities (&), and minimal XSS escaping. Features a searchable reference table of all 2,100+ standard HTML5 named character references categorized by basic XML delimiters, Latin diacritics, punctuation, mathematical operators, directional arrows, currency symbols, and Greek letters. Provides real-time bidirectional conversion, Unicode code point lookup, character category classification, copy-ready code snippets, and gzip-compressed shareable state. Operates 100% client-side in your browser with zero network transmission for complete privacy.
Keywords: html entities encoder, html entities decoder, html entities encode, html entities decode, encode html entities, decode html entities, html entity table, html entity list, named entities, numeric entities, hex entities, html special characters, html escape, html unescape, quot entity, amp entity, lt gt entities, html entities online, free html entities encoder, html character reference, xss escaping tool, html entity converter
Tags: html, entities, encode, decode, entity, special-characters, xss, escape
Popular Web Code tools
- Accessibility CheckerScan HTML for WCAG accessibility issues with AI-powered fix suggestions.
- Bundle Size AnalyzerAnalyze and visualize JavaScript bundle sizes with optimization suggestions.
- SQL FormatterFormat, minify, and validate SQL queries with dialect support.
- SVG OptimizerOptimize, minify, and clean SVG files with configurable SVGO presets.
- Color ConverterConvert colors between HEX, RGB, HSL, oklch, CMYK, and 16+ formats instantly.
HTML Entities Encoder/Decoder is also known as: HTML Escape Tool, HTML Unescape Tool, HTML Entity Decoder, HTML Entity Encoder, HTML Character Reference Finder, Special Character Escaper, HTML5 Entity Table.
How to HTML Entities Encoder/Decoder Online
Paste or type your raw HTML markup or text into the input panel on the left.
Select your action: choose "Encode" to convert special syntax characters into HTML entities, or "Decode" to unescape entities back into human-readable characters.
Choose your target encoding mode: Named Entities (&) for readability, Decimal (&#nnn;) for universal XML/HTML compatibility, Hexadecimal (&#xnn;) for Unicode alignment, or Minimal for strict 5-character XSS escaping.
Review the generated output instantly in the right-hand panel, or press ⌘↵ (Mac) / Ctrl+Enter (Windows) to manually trigger conversion.
Use the searchable Entity Reference Table below the editor to look up code points, hex values, descriptions, and named aliases for 2,100+ standard HTML5 entities.
Click "Copy" or press ⌘⇧C to copy the output to your clipboard, or click "Share" to generate a gzip-compressed URL for collaborating with your team.
HTML Entities Encoder/Decoder Features
Bidirectional encoding & decoding: convert special characters to HTML entities or unescape entity strings back to UTF-8 text.
4 distinct encoding modes: Named Entities (&), Numeric Decimal (&), Numeric Hexadecimal (&), and Minimal Essential escaping (&, <, >, ", ').
Comprehensive HTML5 entity table: instant search and filtering across 2,100+ standard W3C/WHATWG named character references.
Full Unicode & astral plane support: encodes and decodes code points beyond BMP (U+10000+), including emojis and mathematical alphanumeric symbols.
Minimal XSS escape set: cleanly targets only the five core delimiters (&, <, >, ", ') without inflating overall document size.
Real-time auto-conversion: recalculates encoded/decoded strings on keystroke without lag.
Category filtering: isolate entities by Basic Delimiters, Punctuation, Math, Directional Arrows, Currency, Greek Letters, and Symbols.
Character inspection: reveals decimal code point, hexadecimal representation, entity alias, and descriptive name for every symbol.
One-click per-entity copying: copy individual entity strings directly from the reference table.
Shareable state: compresses input text and options into compact gzip URL query parameters for reproducible bug reports.
100% client-side execution: pure in-browser JavaScript with zero server uploads, keeping sensitive HTML payloads and tokens private.
Native keyboard navigation: ⌘↵ to process, ⌘⇧C to copy output, ⌘⇧K to clear canvas.
Supported Formats & Dialects
The HTML Entities Encoder/Decoder supports 5 syntax formats and dialects for accurate parsing and processing.
- Named Character References (&name;)
- Human-readable character references standardized by WHATWG/W3C (such as &, <, >, ", ©, €). Ideal for readable HTML templates and documentation.
- Decimal Numeric Character References (&#[0-9]+;)
- Base-10 Unicode code point references (such as < for < and © for ©). Universally supported across all legacy XML engines, RSS aggregators, and email clients.
- Hexadecimal Numeric Character References (&#x[0-9A-Fa-f]+;)
- Base-16 hexadecimal Unicode references (such as < for < and 😀 for 😀). Aligns directly with official Unicode code point charts (U+003C, U+1F600).
- Minimal XSS Escape Set (&, <, >, ", ')
- Escapes only the five core syntax-breaking characters to neutralize HTML tag breakouts and attribute injections while preserving international characters in modern UTF-8 documents.
- Astral Plane & Supplementary Unicode (U+10000 to U+10FFFF)
- Full 21-bit code point encoding for supplementary characters, emojis, and mathematical alphabets without UTF-16 surrogate pair truncation artifacts.
In-Depth Technical Guides
All GuidesClean HTML to Markdown for LLM & RAG Pipelines: Token Minimization & Semantic Table Extraction
Strip DOM boilerplate, convert complex HTML tables and semantic trees into clean Markdown, slash RAG embedding token costs by 60–80%, and preserve critical context for LLMs.
Debugging Open Graph & Twitter Cards for Dynamic Social Previews
Master Open Graph protocol, Twitter Card meta tags, dynamic OG image generation, and crawler cache invalidation across Slack, Discord, Twitter/X, and LinkedIn.
HTML Entity Encoding & Escaping: XSS Prevention, Unicode & Parser Nuances
Master HTML entity encoding, numeric character references, context-aware XSS escaping in body vs attributes vs JS, and HTML5 named entity parser rules.
URL Encoding & Query Strings: Mastering RFC 3986, encodeURIComponent & URLSearchParams
Demystify percent-encoding rules, avoid double-encoding pitfalls, master + vs %20 space representations, and serialize complex nested objects and arrays for REST query strings.
XML Formatting, Validation & XXE Prevention: The Production Engineering Guide
Master XML formatting standards, well-formedness rules vs XSD validation, namespace resolution, CDATA handling, and server-side XXE attack prevention.
Related Standards & RFC Specifications
All StandardsHTML is the standard markup language for creating web pages and web applications, structuring content through semantic elements and the DOM.
HTML entities are coded character strings starting with an ampersand and ending with a semicolon used to render reserved and special characters in HTML.
The Open Graph protocol enables web pages to become rich graph objects on social networks like Facebook, LinkedIn, Discord, and Slack using semantic meta tags.
URL encoding (percent-encoding) is an RFC 3986 mechanism that converts reserved or unsafe characters in a URI into a percent sign followed by two hex digits.
XML is a flexible, tag-based markup language standardized by the W3C for storing and transporting structured, machine-parseable hierarchical data.
Frequently Asked Questions
- What are the 5 core reserved HTML/XML characters and why must they be escaped?
- The five reserved characters in HTML and XML are less-than (<), greater-than (>), ampersand (&), double quote ("), and single quote (' / '). In HTML lexical analysis, < denotes the start of a tag token, > closes a tag, & initiates an entity reference, and quotation marks delimit attribute values. If these characters appear as raw content inside markup, the browser parser treats them as structural tokens, resulting in broken DOM layouts or Cross-Site Scripting (XSS) vulnerabilities.
- What is the technical difference between named, decimal, and hexadecimal entity references?
- Named entities use mnemonic text aliases defined in the HTML specification (e.g., ", ©, —). They are easy for developers to read, but XML parsers only recognize five default named entities unless an explicit DTD is declared. Decimal entities (&#nnn;) represent the character by its base-10 Unicode code point (e.g., ©), which is universally supported across all XML, SGML, and HTML parsers. Hexadecimal entities (&#xnn;) represent the base-16 code point (e.g., ©), matching Unicode hex notation (U+00A9) and saving characters for higher code points.
- How does HTML entity encoding differ from URL percent-encoding and JavaScript escape sequences?
- HTML entity encoding (<, <) is designed specifically for HTML/XML parser tokenization in web page documents. URL percent-encoding (%3C, %20 per RFC 3986) is designed for HTTP request URIs, query strings, and path segments where non-ASCII and reserved URI characters must be safely transmitted over the wire. JavaScript escape sequences (\u003c, \x3c, \u{1f600}) are string literals interpreted by the ECMAScript engine. Encoding HTML entities inside a URL parameter or JavaScript string will not prevent JavaScript execution or format the URL correctly.
- Why is HTML entity encoding alone insufficient to prevent XSS across all contexts?
- HTML entity encoding is context-dependent. Standard HTML escaping (&, <, >, ", ') is sufficient when rendering untrusted data inside standard HTML body elements (like <div> or <p>) and quoted attribute values (like <input value="...">). However, if user data is placed inside inline <script> blocks, style attributes, or dangerous URI attributes like <a href="...">, browsers execute JavaScript or evaluate CSS expressions regardless of HTML entity encoding. In JavaScript contexts, JSON serialization or context-aware JavaScript escaping must be used, and href values must validate the URI scheme (blocking "javascript:").
- What is the difference between Minimal/Smart escaping and Full Non-ASCII entity encoding?
- Minimal/Smart escaping only transforms the 5 characters that alter HTML grammar (&, <, >, ", '), leaving all other international characters (such as é, ñ, 漢字, or emojis) in their raw UTF-8 form. This minimizes payload size and preserves readability in modern UTF-8 web applications. Full Non-ASCII entity encoding converts every character outside the standard 7-bit ASCII range (ASCII > 127) into numeric character references (&#nnn;), guaranteeing safe transport across legacy 7-bit ASCII email channels or systems with unknown charset configurations.
- How does the HTML5 parser handle legacy entity quirks and missing semicolons?
- The WHATWG HTML5 specification defines strict parsing rules for backward compatibility with legacy web content. Many common named entities (such as &, <, ©, ®) are tolerated without a trailing semicolon in text nodes for historical reasons. However, in attribute values, an entity without a semicolon followed by an alphanumeric character or equals sign is treated as literal text to avoid breaking URL query parameters (e.g., href="page?a=1©=2"). Best practice is to always terminate all entities with a semicolon (;) to ensure deterministic parsing.
- How are Unicode astral plane characters and emojis handled in HTML entities?
- Characters beyond Unicode code point U+FFFF (such as the grinning face emoji 😀 at U+1F600 / decimal 128512) belong to the supplementary astral planes. In HTML numeric character references, they can be represented directly as decimal 😀 or hexadecimal 😀. JavaScript engines using UTF-16 internally represent these as surrogate pairs (\uD83D\uDE00), so proper encoding algorithms must use codePointAt() and String.fromCodePoint() rather than charCodeAt() and fromCharCode() to prevent splitting surrogate pairs.
- Are HTML entities still necessary on modern websites configured with UTF-8 charsets?
- On modern websites with <meta charset="utf-8">, you do not need entities for typographical symbols (like ©, —, «), currency signs (€, £, ¥), or foreign alphabets because UTF-8 natively supports all 1.1 million Unicode code points. However, the five structural syntax characters (<, >, &, ", ') MUST still be escaped whenever they appear as literal text data rather than HTML tags or attribute boundaries. HTML entities remain mandatory for preventing parser breakage and securing dynamic user content against XSS.
Related Developer Tools
- HTML FormatterFormat, minify, and validate HTML with attribute sorting and template support.
- Meta Tag GeneratorGenerate SEO meta tags, Open Graph, Twitter Cards, and JSON-LD structured data.
- URL Encoder/DecoderEncode, decode, and parse URLs and query strings instantly.
- Text Case ConverterConvert text between 20+ case formats: camelCase, snake_case, kebab-case, Title Case, and more.
- HTML to MarkdownConvert HTML to Markdown with support for GFM, CommonMark, and Obsidian syntax.
- Markdown PreviewPreview and render Markdown with GFM, math, Mermaid diagrams, and export options.
- XML FormatterFormat, beautify, validate, minify, and convert XML to JSON with syntax highlighting.
- CSP Builder & ValidatorBuild and validate Content Security Policy headers with security scoring.