HTML Escape
Encode special characters to HTML entities and decode them backMode:Scope:
Input
Ctrl↵
About HTML Escape
Encode special HTML characters (<, >, &, ", ') to their HTML entity equivalents (<, >, &, ", '), or decode entities back to plain text. Useful for safely embedding user content in HTML, working with template engines, or debugging escaped markup.
Frequently Asked Questions
What is HTML entity encoding?
HTML entity encoding converts characters with special meaning in HTML — such as <, >, &, and " — into entity equivalents (<, >, &, "). This prevents user-supplied content from being interpreted as HTML markup, blocking cross-site scripting (XSS) attacks.
What is the difference between named HTML entities and numeric entities?
Named entities use a mnemonic: & for &, < for <, © for ©. Numeric entities use the Unicode code point in decimal © or hex © — both represent ©. Named entities only exist for commonly used characters; any Unicode character can be expressed as a numeric entity. Modern HTML5 documents in UTF-8 can use the actual Unicode character directly without encoding.
Which HTML characters must always be encoded to prevent XSS?
The five characters critical for XSS prevention are: & → &, < → <, > → >, " → ", and ' → ' (or '). In HTML attribute values, both < and the quote character surrounding the attribute must be encoded. Modern templating engines (React, Vue, Jinja2) encode these automatically — manual encoding is needed only in raw string concatenation.
Why do I need HTML entities if my page uses UTF-8 encoding?
With UTF-8 and <meta charset="UTF-8">, most Unicode characters can be placed directly in HTML without encoding. HTML entities are still required for characters with structural meaning in HTML (< > & " ') and occasionally for very old browsers. Using the actual Unicode character (©, €, →) is preferred over named entities in modern UTF-8 HTML.
How do I decode HTML entities in JavaScript or Python?
JavaScript: const txt = document.createElement("textarea"); txt.innerHTML = encodedString; const decoded = txt.value. Node.js: use the he library (npm install he): he.decode("<b>"). Python: from html import unescape; unescape("<b>") returns "<b>". PHP: html_entity_decode($string).