HTML Entity Encoder

The Complete Guide to HTML Entities

When writing HTML, certain characters are reserved. For example, the less-than (<) and greater-than (>) signs are used to define HTML tags. If you want to display these actual characters on a webpage (such as in a code tutorial), you cannot type them directly. Instead, you must use HTML entities. Our free HTML Entity Encoder instantly converts text back and forth between raw characters and their safe HTML entity representations.

What is an HTML Entity?

An HTML entity is a snippet of text that begins with an ampersand (&) and ends with a semicolon (;). When a web browser encounters this pattern, it interprets it as a command to render a specific character, rather than treating it as HTML markup.

Entities can be written by name or by their numeric character reference (decimal or hexadecimal).

Common HTML Entities

Here are the most critical entities every web developer must know:

• Less-than (<): < — Crucial for displaying code snippets.
• Greater-than (>): > — Paired with less-than to close tags.
• Ampersand (&): & — Because the ampersand starts an entity, you must encode it to display it.
• Double quote ("): " — Used to safely display quotes inside HTML attributes.
• Single quote/Apostrophe ('): ' or '
• Non-breaking space:   — Forces a space that the browser will not collapse or break across lines.

HTML Entities and Web Security (XSS)

Encoding HTML entities is not just about displaying code; it is a fundamental security practice. Cross-Site Scripting (XSS) is a vulnerability where attackers inject malicious JavaScript into your website (e.g., through a comment form). If you display their input raw on the page, the browser will execute the script.

By passing user input through an HTML Entity Encoder before displaying it, a malicious script like <script>alert(1)</script> is safely converted into <script>alert(1)</script>. The browser renders the text on the screen, but it does not execute it.

URL Encoding vs. HTML Encoding

These two concepts are often confused, but they serve different purposes:

• HTML Encoding (Entities): Used to safely display text inside an HTML document (e.g., converting < to <).
• URL Encoding (Percent Encoding): Used to safely pass text through a URL string (e.g., converting a space to %20).

Use our free HTML Entity tool to secure your user input or format code tutorials. If you need to encode data for a web address, use our URL Encoder instead.