HTML Entity Encode/Decode

About the HTML Entity Encode/Decode

The HTML Entity Encoder & Decoder on HT99 Tools converts between literal characters and HTML entity references. The five characters that have syntactic meaning in HTML — &, <, >, ", ' — must be encoded as entities whenever they appear as text content or attribute values, otherwise the browser may interpret them as markup.

Encoding is the first line of defence against cross-site scripting (XSS). If you render user-supplied input into a page and forget to escape <script>, the browser will execute that script. The OWASP Encoder Project and the WHATWG HTML Living Standard §13.5 both list exactly these five characters as the minimum set that must be escaped in text content.

This tool offers both named entities (&, <, >, ") and numeric character references (&, <, >, "). Numeric references are preferred when maximum compatibility is required, because named entities are not understood by every XML parser.

Context matters: text content needs only &, <, and > escaped. A double-quoted attribute value also needs " escaped; a single-quoted value also needs '. The tool offers the single-quote escape as an option because most modern templates use double-quoted attributes and can skip it — but enabling it costs nothing and protects against the case where a developer switches quote style later.

How It Works

The WHATWG HTML Living Standard §13.5 (the Named Character References table) defines over 2,000 named entities, but only five are needed for safe escaping: & → &, < → <, > → >, " → ", ' → '. The order matters: & must be replaced first, or the other replacements would themselves be re-encoded.

The single-quote entity uses the numeric form ' because ' is defined in XML but is not in the HTML 4 specification and was only added to HTML5 — some legacy parsers (notably Internet Explorer) do not understand '. Numeric references work everywhere.

Decoding uses the browser's own parser: a <textarea> element is created, its innerHTML is set to the encoded string (which the browser parses, resolving every entity), and the value property is read back. This approach handles every named entity, every numeric reference (decimal and hex), and is identical to what the browser does when it renders your page.

Worked Examples

Encoding the default input Render this literally: <script>alert("XSS")</script> & <b>bold</b> tags. with named entities produces Render this literally: <script>alert("XSS")</script> & <b>bold</b> tags.. Paste that into an HTML file and the browser will display the original text verbatim, without executing the script.

Switch to numeric mode and the same input becomes Render this literally: <script>alert("XSS")</script> & <b>bold</b> tags. — identical behaviour, but each entity works even in XML parsers that do not know the HTML named entities.

Decoding reverses either form. Pasting café & crème yields café & crème, correctly resolving both the named é and the numeric è to the same character.

When to Use This Tool

• Escaping user input before rendering it as text content (the single most common XSS defence).
• Encoding text for inclusion in an HTML attribute value (where both quotes may appear).
• Displaying code snippets in a blog post so that <div> renders as text, not as a div.
• Decoding entity-encoded strings received from RSS feeds or XML APIs.
• Producing numeric-only entities for output that must be valid in both HTML and XML.
• Inspecting emails encoded with " and & to read the literal subject lines.
• Sanitising CMS content before it is fed into a search indexer.

Limitations & Disclaimer

The tool escapes the five HTML-significant characters only. It does not escape Unicode control characters, null bytes, or surrogate-pair characters. It is not a full HTML sanitiser: it will not strip <script> tags — it will escape them so the browser renders them as text, which is the correct behaviour for displaying code but is not a substitute for a sanitiser like DOMPurify when the input is meant to be rendered as live HTML. The decoder resolves every named entity the browser supports, which is over 2,000 — but not every entity is round-trip-stable across browsers. See our disclaimer for full terms.

Frequently Asked Questions

Last updated: September 9, 2026  ·  Author: HT99 Tools Editorial Team