ITBox
Switch tool

HTML Entities

Convert between plain text and HTML entities: encode as named entities or decimal / hex numeric references, escaping only HTML-unsafe characters or all non-ASCII; decode &name;, &#NN; and &#xNN; references back to characters (astral/Emoji safe).

Mode
Format

Named: prefer a named entity, fall back to numeric.

Plain text
0 chars
Encoded output
0 chars

How to use

Purpose

Online HTML entity encoder/decoder. Converts < > & " ' to entities (&lt; &gt; &amp; &quot; &#39;) and back. Supports named entities (&copy; &nbsp; &mdash;) and numeric entities (&#160; &#x00A0;). Common for safely embedding user input in HTML (XSS defense), displaying code in blogs, and HTML email compatibility. All conversion runs locally.

Steps

  1. Paste HTML or text with special characters
  2. Click Encode to convert < > & " ' to entity forms
  3. Reverse: paste entity-containing text and click Decode
  4. Modes: Basic (just the 5 core characters), All (encode all non-ASCII), Named entities (&copy; instead of &#169;)
  5. Numeric entity format: decimal (&#169;) or hex (&#x00A9;)
  6. Newline handling: optionally convert \n to <br />
  7. Quick reference: &nbsp; (non-break space), &emsp; (em-space), &mdash; (em dash), &hellip; (ellipsis)

FAQ

Which characters MUST be HTML-encoded?
The 5 core: < (&lt;), > (&gt;), & (&amp;), " (&quot;), ' (&#39; or &apos;). Other characters (CJK, digits, spaces) in UTF-8 docs do not need escaping. Failing to encode the 5 causes HTML parsing breaks or XSS vulnerabilities.
Is HTML entity encoding enough for XSS defense?
No. HTML entities only protect injection into HTML text. Attribute values, JavaScript contexts, URLs, and CSS each have their own encoding rules. Full XSS defense: 1) HTML text → HTML entities; 2) HTML attributes → attribute-specific encoding; 3) JS strings → \uXXXX; 4) URLs → percent encoding. Libraries like DOMPurify automate this.
What is &nbsp; and how is it different from a regular space?
&nbsp; is a non-breaking space (U+00A0). A regular space lets the line wrap; &nbsp; does not. Uses: 1) keep "10 km" together; 2) preserve consecutive spaces (HTML collapses runs of normal spaces, not nbsp); 3) typography micro-adjustments.
Should I use named entities (&copy;) or numeric (&#169;)?
Modern HTML5 prefers writing © directly (UTF-8 supports it). If you must escape: named entities are readable but only ~250 have names. Numeric covers all of Unicode but is unreadable. For XML / strict use, numeric (&#xA9; hex) is more portable.
Why does my code snippet with <script> execute on my blog?
The platform did not escape it. You need &lt;script&gt; instead of <script>. The Encode button does this. Or use Markdown code fences (```) — renderers auto-escape. Rich-text editors (CKEditor, TinyMCE) lose escaping when pasting code as a normal paragraph; use "insert code block" instead.

Use cases

  • XSS defense: encode user input before injecting into HTML
  • Code display on blogs: convert <html> to &lt;html&gt; so browsers do not execute it
  • HTML email: convert CJK / special chars to entities for legacy email clients
  • Scrape cleanup: decode entities in scraped HTML to recover readable content
  • Generating RSS/Atom: & must become &amp; or XML parsers fail

Use cases

XSS defense, displaying code in blogs, HTML email compatibility, scrape cleanup, RSS/Atom generation. Frontend, backend, scrapers, email marketing, technical bloggers. Basic/All/Named modes and decimal/hex numeric entities are the differentiators.