HTML Entity Converter
100% LocalEncode and decode HTML entities and special characters.
Content Sanitization
Escapes characters like <, >, and & for use in HTML content.
Type text to encode special characters as HTML entities, or paste entities to decode back.
What is HTML Entity Converter?
Frequently Asked Questions
Technical Deep Dive
HTML Entity Converter
Convert special characters to their HTML entity equivalents (e.g., & into &) and vice-versa. Essential for web developers ensuring content displays correctly in HTML documents and avoiding XSS vulnerabilities.
Spec-Compliant
Follows the RFC or de-facto encoding rules, no custom dialects, no surprises.
Lossless Round-Trip
Encode then decode and you get back exactly what you put in, byte for byte.
Handles Edge Cases
Unicode, padding, invalid input, surfaced clearly instead of silently mangling output.
01 Critical Escaping Matrix
| Literal | Entity Code | Numeric Code | Required Context |
|---|---|---|---|
< | < | < | HTML Body & Attribute |
> | > | > | HTML Body & Attribute |
& | & | & | Global (All Contexts) |
" | " | " | Attribute Values |
' | ' | ' | Attribute Values |
02 Entity Transformation Flow
03 When You Reach for HTML Entities
Entity encoding is the boundary between "this is text" and "this is HTML markup." Get it wrong and either the page breaks visually or, much worse, a stored XSS slips through to your users.
-
Sanitizing user-generated content A comment field that allows raw
<script>tags is a stored-XSS factory. Escaping the four critical characters (< > & ") at output time is the OWASP-recommended baseline. Frameworks like React and Vue do this for you on string interpolation. -
Embedding code samples in <pre> / <code> Docs that render literal HTML examples need to escape
<and>even inside<pre>. The browser still parses tags there,<pre>only preserves whitespace, not HTML semantics. -
HTML email templates Marketing footers with
©2026, currency strings like€9.99, and non-breaking spaces ( ) all rely on named entities. Many email clients still trip over raw UTF-8, so entity references remain the safe path. -
URLs embedded in HTML attributes An
hrefcontaining a URL with&separators must encode each&as&, otherwise the HTML parser eats the next parameter. This is double work because the URL itself is already percent-encoded. -
Sanitizing content for a JavaScript string literal HTML entities do nothing inside a
<script>block, the JS parser ignores them. Escape with JSON-encoding or a dedicated JS-string escaper. Mixing the two is a frequent XSS root cause.
04 Worked Examples
<script>alert(document.cookie)</script><script>alert(document.cookie)</script>The browser now renders this as literal text rather than executing it. This is the single most important XSS mitigation for content that is not supposed to contain markup.
named: &
decimal: &
hex: &
&Named entities are limited (~250 in HTML5); numeric entities cover every Unicode code point. For non-ASCII text the numeric forms always work, even in ancient email clients that never learned ….
Tom & JerryTom & JerryTom &amp; Jerry → shows as "Tom & Jerry"If you see &amp; in your output, escaping is happening twice in the pipeline. Pick one layer, usually the template renderer, and make sure the data that reaches it is raw.
05 Related Tools
Escaping is rarely isolated, different contexts in the same page need different escapers. These pair naturally with HTML entities.
URL Encoder
For href and src attribute values, a URL inside HTML often needs both percent and entity encoding.
String Escaper
When the content goes inside a JavaScript string literal or JSON, HTML entities don't apply, use language-level escaping.
Text Diff
Compare before/after escaping to spot exactly which characters were touched, useful when debugging template engines.