HTML Entity Converter
Escape special characters for HTML, or decode them back.
Why HTML entities matter
Characters like <, > and & have structural meaning in HTML, so displaying them literally requires escaping — otherwise the browser interprets them as markup. The classic case is showing code samples on a page: every angle bracket must become < and > or the snippet vanishes into the DOM.
Escaping user-generated content before inserting it into HTML is also the front line of XSS defense: <script> typed by a visitor must render as text, never execute. Decode mode strips entities back to plain characters — useful for reading escaped content in configs, feeds and copied source code.
FAQ
What's the difference between named and numeric entities?
Named ones (&, ) are readable; numeric ones (&,  ) cover every Unicode character, including those with no name. Numeric output is always safe for any character.
Does escaping protect against all XSS?
Escaping text contexts, yes. Inside attribute values, URLs or JavaScript strings, additional context-specific escaping rules apply — escape for the context you're writing into.