HTML entities are special codes used to display reserved characters in HTML. For example, '<' is encoded as '<' and '&' as '&'. This prevents browsers from interpreting them as HTML tags.
Always encode user-provided text before inserting it into HTML to prevent XSS (Cross-Site Scripting) attacks. For example, if a user enters '<script>', it should become '<script>'.
The HTML preview renders raw HTML in a sandboxed iframe so you can see how it looks in a browser without executing any scripts.
The standard HTML entities are: & β &, < β <, > β >, " β ", ' β '. Extended encoding also covers accented characters, copyright symbols, and more.
At minimum, always escape these five: & (β &), < (β <), > (β >), " (β "), and ' (β '). These prevent XSS and HTML injection when inserting user-provided content into web pages.
Named entities use a descriptive name: & for &, < for <. Numeric entities use the Unicode code point: & for & (decimal) or & for & (hex). Both are valid; named entities are more readable.
XSS attacks inject malicious scripts via user input. If a user submits '<script>alert(1)</script>', entity-encoding converts it to '<script>alert(1)</script>' β the browser displays it as text instead of executing it as code.
HTML entities are essential for web security. Any user-provided content inserted into HTML must be entity-encoded to prevent Cross-Site Scripting (XSS) β one of the most common web vulnerabilities. This tool also lets you preview raw HTML in a safe sandboxed environment.
Choose your mode
Select 'Encode' to convert special characters to HTML entities (< β <). Select 'Decode' to convert entities back to characters. Use 'Preview' to render raw HTML and see how it looks in a browser.
Paste your input
For encoding: paste user-provided text or content that needs to be safely embedded in HTML. For decoding: paste HTML-encoded text to make it human-readable. For preview: paste complete HTML markup.
Read the output
The encoded, decoded, or rendered result appears instantly. For the preview mode, HTML is rendered in a sandboxed iframe β JavaScript is disabled for security.
Copy and use in your code
Copy the entity-encoded output and insert it into your HTML templates, email content, or anywhere user content needs to appear safely.
Prevent XSS vulnerabilities
Before inserting user input into HTML (in template engines, email generators, or static site builders), entity-encode it here to confirm the encoding is correct. Characters like <, >, &, and " must be encoded to prevent script injection.
Debug escaped HTML
CMS systems, email clients, and databases often store HTML with entities. Decode the text here to see the original content without the encoding noise.
Test email HTML
Email clients have inconsistent HTML support. Use the preview mode to render your email HTML and catch rendering issues before sending β without needing to send a test email.
HTML entity encoding converts reserved HTML characters β <, >, &, ", ' β into their equivalent entity references (<, >, &, ", '). This is essential for safely rendering user-supplied content in an HTML page. Inserting unescaped user input directly into HTML is the root cause of Cross-Site Scripting (XSS) attacks, one of the most common web security vulnerabilities.
Use this tool when you need to safely display code snippets, user-generated text, or API response data inside an HTML template, or when you want to understand what entity sequences a browser is actually receiving from a server. The decoder direction is equally useful when parsing HTML content and extracting the original text from entity-encoded strings.