What are HTML entities?
HTML entities are text sequences like < and & that represent characters HTML would otherwise treat as markup — <, >, &, quotes, and more. Encoding replaces those characters with their entity so the browser displays them literally instead of interpreting them as a tag or attribute boundary.
When do you need this?
- Displaying a code snippet (like
<div>) as visible text on a page instead of rendering it - Safely inserting user-provided text into HTML to prevent it from breaking the page or enabling XSS
- Decoding entity-escaped text copied from a CMS or API response to read it in plain form
Frequently asked questions
Does encoding HTML entities prevent XSS attacks?
Encoding the characters that define HTML markup — <, >, &, quotes — is one of the standard defenses against injecting unwanted HTML or scripts. It's necessary but not sufficient on its own; context matters (attribute values, JS strings, URLs each need different escaping), so always use your framework's built-in escaping for real security-sensitive output.
What's the difference between < and <?
Both represent the same character (<). < is a named entity; < is the same character referenced by its numeric code point. Browsers treat them identically.
Is my data uploaded when I use this tool?
No. Encoding and decoding both happen instantly in your browser — nothing is sent to a server.