Encode special characters as HTML entities or decode entities back to plain text. Prevents XSS and ensures safe HTML rendering.
| Character | Entity Name | Numeric | Description |
|---|---|---|---|
| & | & | & | Ampersand |
| < | < | < | Less than |
| > | > | > | Greater than |
| " | " | " | Double quote |
| ' | ' | ' | Single quote |
|   | Non-breaking space | |
| © | © | © | Copyright |
| ® | ® | ® | Registered trademark |
| ™ | ™ | ™ | Trademark |
| € | € | € | Euro sign |
& and end with ;. For example, < represents < (less-than sign), which would otherwise start an HTML tag. Named entities like © represent symbols like ©.<script> is rendered as literal text instead of executed), displaying literal HTML source code on a page, safely including user content in HTML templates, and displaying characters like <, >, and & as content rather than markup.& for &, © for ©. Numeric entities use the Unicode code point: decimal & or hexadecimal & for &. Both are equivalent in browsers. Numeric entities can represent any Unicode character even if no named entity exists; named entities are more readable when they exist.< → <, > → >, & → &, " → " (inside attribute values), and ' → ' (inside single-quoted attributes). In HTML5, the forward slash / does not need encoding but is sometimes encoded for XHTML compatibility.<script> tag), use JSON encoding. For URL attributes (href, src), validate and use a URL-safe encoding. For CSS, use CSS-specific encoding. Context-appropriate encoding is required; HTML encoding alone is not sufficient for all injection points.&entity; format for safe inclusion in HTML markup. URL encoding converts characters to %xx percent-encoded format for safe use in URLs. They serve different contexts and are not interchangeable. A URL inside an HTML attribute should be URL-encoded first, then the whole attribute value HTML-encoded — for example: <a href="search?q=a%26b"> where %26 is URL-encoded and the outer HTML is safe.htmlspecialchars() encodes the five critical HTML characters (&, ", ', <, >) and is the recommended function for output escaping in PHP templates. htmlentities() additionally encodes all characters that have named HTML entity equivalents. This tool's "encode" mode encodes the same five critical characters; enabling the extended option also encodes non-ASCII characters as numeric entities. (Non-Breaking Space, U+00A0) is a space character that prevents line breaks between two words. Use it when you want two words to stay on the same line (e.g., "100 km", "Mr. Smith") or to add spacing in HTML where normal spaces collapse. However, avoid overusing it for layout — CSS properties like white-space: nowrap or margin are more appropriate for layout purposes.&#code_point; in decimal or &#xHEX; in hex. For example, the emoji 😀 is 😀 or 😀. This allows you to include any character in HTML documents that are encoded as ASCII or Latin-1, though for UTF-8 HTML documents (the modern standard) you can usually include Unicode characters directly without entity encoding.<, >, &, ", and '. Other HTML named entities like © are not defined in XML and will cause parsing errors unless you declare them in a DOCTYPE. Use numeric entities (©) instead of named entities for maximum XML compatibility.This free HTML entities encoder and decoder converts special characters to their HTML entity equivalents and back. All conversion runs in your browser — no data is sent to a server. Essential for XSS prevention and safe HTML output.
In-depth guides and technical articles.
