HTML Entities Encoder & Reference Table

An HTML entity can be written in three distinct formats, all of which resolve to the same unicode character in the browser:

• Named Entities: Friendly mnemonic names that are easy to remember. For example, & for ampersand, " for double quote, and © for the copyright symbol. Not all Unicode characters have named entities.
• Decimal Code Points: The character code represented in base-10 format, prefixed with a hash sign. For example, the ampersand is represented as &.
• Hexadecimal Code Points: The character code represented in base-16 format, prefixed with a hash sign and an "x". For example, the ampersand is represented as &. Hexadecimal is standard for Unicode notations.

HTML entity encoding is a key defense mechanism against Cross-Site Scripting (XSS) vulnerabilities. XSS occurs when an application takes user input (such as a comment or username) and renders it directly on a page without sanitization.

If an attacker inputs <script>maliciousCode()</script>, a vulnerable application will execute the script. However, if the application runs the input through an entity encoder before rendering, the characters are converted to <script>maliciousCode()</script>. The browser will display the raw code as safe text on the screen instead of executing it, neutralizing the injection attack.

Historically, before the adoption of UTF-8, developers had to use HTML entities for every non-English character to prevent encoding corruption (mojibake) when pages were loaded on different systems.

With the universal adoption of UTF-8, which supports over 1.1 million characters, developers can write characters like ©, é, or emojis directly in their HTML files. However, escaping reserved characters (<, >, &, ", and ') remains mandatory to prevent HTML parsing conflicts, making entity encoders an essential tool in every developer's toolkit.

Choose Encode to escape reserved markup characters in raw text, or Decode to convert entity syntax back into plain readable characters. Type or paste your content and the result updates instantly, with a Copy Result button for quick reuse.

Use the searchable Entity Reference Table below to look up a specific symbol by name, description, or code. Click any cell to copy that entity format directly.

Encoding the raw markup <div>Hello & welcome!</div> produces <div>Hello & welcome!</div>: every reserved <, >, and & character is replaced with its named entity so the string can be safely displayed as text instead of being parsed as HTML.

Decoding that same escaped string in Decode mode reconstructs the original markup exactly, <div>Hello & welcome!</div>, confirming the round-trip is lossless.

For other web-safe encoding tasks, see the URL Encoder & Decoder and the Base64 Text & File Converter. For raw byte-level inspection, try the Binary, Hexadecimal & ASCII Converter.

If you are testing how a field handles a fixed length rather than a specific string, the Lorem Ipsum Generator will produce filler text of an exact character count to escape and paste in.