What HTML entities are and why they matter
HTML reserves certain characters for its own syntax. The less-than sign opens a tag, the ampersand begins an entity reference, and the double quote delimits attribute values. If these characters appear in your content literally, the browser misinterprets them as markup. HTML entities solve this by replacing each reserved character with a safe textual representation: `<` becomes `<`, `>` becomes `>`, `&` becomes `&`, the double quote becomes `"`, and the single quote becomes `'`. The HTML Entities tool at /developer-tools/encoders/html-entities performs these conversions live as you type.
Failing to encode user-generated content before injecting it into the DOM is the root cause of cross-site scripting (XSS) vulnerabilities. Even in static HTML, an unencoded ampersand in a URL can break attribute parsing. Encoding is not optional for well-formed documents.
Encode mode: the five XML-safe replacements
Encode mode targets only the five characters that XML and HTML define as special. This minimal set is sufficient to safely embed any text inside an HTML document. The replacements are: ampersand to `&`, less-than to `<`, greater-than to `>`, double quote to `"`, and single quote to `'`.
The choice of `'` over `'` for the apostrophe is deliberate. While `'` is defined in XML and HTML5, it is not recognized in HTML4. Using the numeric reference `'` guarantees compatibility across all HTML versions and XML parsers. All other characters, including emoji and non-ASCII Unicode, are left unchanged because they are valid in UTF-8 encoded HTML documents.
Decode mode: named, decimal, and hex references
Decode mode reverses the process and handles a wider range of inputs than Encode produces. It recognizes named entities such as `&`, `<`, `>`, `"`, `'`, and ` `. It also resolves decimal numeric references like `’` and hexadecimal references like `’` for the right single quotation mark. Any valid code point up to U+10FFFF is supported via `String.fromCodePoint`, which means emoji encoded as numeric references are decoded correctly.
Unknown entity names that do not match the recognized set are left intact, so partial or malformed input degrades gracefully rather than corrupting your text. This makes the tool safe for batch-processing mixed content where some entities may already be decoded.
Entity type comparison
| Entity Type | Example | Use Case |
|---|---|---|
| Named | & < | Human-readable, common characters |
| Decimal | < ’ | Any Unicode code point |
| Hex | < ’ | Compact, any code point |
| Numeric apostrophe | ' | HTML4-safe single quote |
Encode mode outputs named entities for the five XML characters and `'` for the apostrophe. Decode mode accepts all three types shown above and produces the actual Unicode characters.
Step-by-step: encoding and decoding
Select Encode or Decode mode using the toggle at the top.
Paste your text or HTML in the input area. The output updates live as you type.
Use the swap button to feed the output back into the input for a round-trip test.
Copy the result with one click. No uploads, no server calls.
For related encoding tools, see /blog/url-encode-decode for percent-encoding and /blog/base64-encode-decode for Base64. To format JSON that may contain encoded entities, try /blog/json-formatter. For rendering Markdown that may include HTML, see /blog/markdown-preview.
XSS prevention and safe rendering
When you display user-supplied text in an HTML page, encoding the five special characters prevents the browser from interpreting that text as markup. Consider a user who enters `<script>alert(1)</script>` in a comment field. Without encoding, the script tag executes. After encoding, the browser renders the literal text `<script>alert(1)</script>` because the angle brackets have been replaced with `<` and `>`. This is the foundational defense against reflected and stored XSS.
Modern frameworks like React and Vue auto-escape expressions, but raw HTML manipulation with `innerHTML` still requires manual encoding. This tool gives you a quick way to encode a snippet before inserting it via `innerHTML` in vanilla JavaScript.
Handling emoji and non-ASCII text
Encode mode leaves emoji and other non-ASCII characters unchanged. This is correct behavior: UTF-8 encoded HTML documents can contain any Unicode character directly without entity encoding. You only need to encode the five reserved characters. If you specifically need to encode emoji as numeric references (for example, to include them in an ASCII-only transport), that is outside the scope of this tool, but Decode mode will correctly resolve such references if you encounter them.
Common non-ASCII characters that appear in web content include accented letters like e-acute and u-umlaut, currency symbols, and mathematical operators. None of these require encoding in a UTF-8 HTML document. The Encode mode deliberately avoids unnecessary entity conversion because it would make the source harder to read and maintain. Only the five characters with syntactic meaning in HTML are transformed.
Privacy: fully client-side processing
This is important because developers frequently paste API keys, credentials, or personally identifiable information into encoder tools. A server-side tool could log that data. By keeping the logic client-side, EasyDevTools guarantees that your sensitive text never leaves your device. Visit /about for details on our privacy practices.
Frequently asked questions
Q: Which entities does Encode produce?
A: Only the five XML/HTML characters: the ampersand, less-than, greater-than, double-quote, and single-quote become `& < > " '`. This is the minimum needed to safely embed text in HTML.
Q: What does Decode handle?
A: Named entities like `&` and ` `, decimal numeric references like `’`, and hex references like `’`. Unknown entities are left intact.
Q: Why use ' instead of '?
A: `'` works in both HTML and XML. `'` is not defined in HTML4, so the numeric form is safer.
Q: Does it handle emojis?
A: Decode handles any numeric code point up to U+10FFFF via `String.fromCodePoint`, including emoji. Encode leaves non-ASCII characters unchanged.
Q: Is the text uploaded?
A: No. Encoding and decoding happen entirely in your browser.
