HTML Entity Encoder & Decoder (Named, Decimal, Hex)
Encode and decode HTML special characters into named entities, decimal character references, or hexadecimal codes. Prevent XSS and format code snippets with full HTML5 entity support.
HTML Entity Quick Reference & Common Symbols
| Glyph | Named | Decimal | Hex | Description |
|---|---|---|---|---|
| & | & | & | & | Ampersand |
| < | < | < | < | Less than |
| > | > | > | > | Greater than |
| " | " | " | " | Double quotation mark |
| ' | ' / ' | ' | ' | Single quote / apostrophe |
| © | © | © | © | Copyright sign |
| ® | ® | ® | ® | Registered trademark |
| € | € | € | € | Euro currency symbol |
| £ | £ | £ | £ | Pound sterling symbol |
| ™ | ™ | ™ | ™ | Trademark symbol |
About HTML Entity Encoder & Decoder (Named, Decimal, Hex)
Web browsers treat characters like angle brackets (< and >), ampersands (&), and quotation marks as special syntax markers in HTML. Displaying these characters as literal text requires replacing them with HTML entities to prevent rendering errors and Cross-Site Scripting (XSS) vulnerabilities.
This workstation encodes reserved characters and symbols into Named HTML5 entities (&, <, >, ", ©), Decimal character codes (&, <), and Hexadecimal references (&, <), while providing a memory-safe decoder that translates escaped entities back to human-readable text.
The engine features configurable scopes (Reserved syntax only, Reserved plus Non-ASCII characters, or Complete string obfuscation), bidirectional input/output swapping, real-time character/entity telemetry, and an interactive HTML Entity Quick Reference catalog.
To secure web forms, percent-encode query strings with the URL encoder and decoder and preview rendered text using the markdown previewer.
Step-by-step practical guide
- Paste your raw text, HTML markup, or code snippet into the Input Content textarea.
- Select your encoding scope: Reserved HTML only, Reserved + Non-ASCII characters, or Encode Every Character.
- Click Encode Named for mnemonic HTML5 entities, Encode Decimal for &#..; codes, or Encode Hex for &#x..; codes.
- To convert encoded entities back to plain text, click Decode Entities.
- Use the ⇄ Swap button to invert input and output textareas for iterative encoding tests.
- Click Copy to copy the output or Download to export an HTML file locally.
- Open the HTML Entity Quick Reference drawer to search and copy common symbols like copyright, euro, and trademark.
Engineering specifications and execution details
Covers HTML5 named entity specifications, including currency symbols (cent, pound, yen, euro), math operators (infin, asymp, radic), and typography marks.
Decoding utilizes the browser DOMParser engine in an isolated document fragment, eliminating any script execution or XSS triggers.
Supports decimal character references (&#[0-9]+;) and hexadecimal references (&#x[0-9a-fA-F]+;) across the full Unicode code point plane.
Real-time telemetry computes input characters, output characters, and total entity tokens using client-side regular expressions.
Searchable reference table filters entries in real time across character glyphs, named tags, decimal numbers, and hex codes.
Data privacy and memory isolation
String encoding operates purely inside browser JavaScript memory.
No code blocks, HTML documents, or text snippets are uploaded to external servers or logged in persistent browser cache.
Common production use cases
- Technical writers and bloggers embedding HTML code snippets inside blog posts, documentation, and markdown files.
- Web developers preparing user-generated text for safe rendering inside XML feeds, SVG templates, and HTML attributes.
- Security researchers testing how web applications parse, normalize, and sanitize encoded entity sequences.
- Email template designers encoding special characters to avoid email client rendering bugs across Outlook and Gmail.
- Frontend software engineers escaping dynamic strings before insertion into DOM templates.
Edge cases and operational boundaries
- Ampersand order: When encoding, ampersands are encoded first to avoid double-encoding characters that were already part of an entity.
- Quotation marks: Double quotes convert to " and single quotes convert to ' to ensure safe HTML attribute insertion.
- Entity termination: Named entities in HTML5 require terminating semicolons. Unterminated entities in legacy code are decoded where possible according to standard fallback rules.
- Hexadecimal entities: Decimal entities (<) and hexadecimal entities (<) both resolve to the same underlying character during decoding.
Frequently Asked Questions
Why must ampersands (&) and angle brackets (<, >) be encoded in HTML?
Browsers treat angle brackets as delimiters for HTML tags and ampersands as the introductory prefix for entity references. If left unescaped in dynamic content, the browser will interpret them as actual markup or execute script tags, leading to parsing errors and Cross-Site Scripting (XSS) security vulnerabilities.
What is the difference between Named, Decimal, and Hexadecimal entities?
Named entities use mnemonic keywords such as © or &. Decimal entities represent the Unicode code point in base 10 (e.g. © for copyright). Hexadecimal entities represent the code point in base 16 (e.g. ©). All three render identically in modern browsers.
What are the five core XML and HTML predefined entities?
The five universal predefined entities are " (double quote, "), & (ampersand, &), ' (single quote/apostrophe, '), < (less than, <), and > (greater than, >).
Does this tool prevent Cross-Site Scripting (XSS)?
Encoding special characters converts malicious payload strings like <script>alert(1)</script> into literal display strings like <script>alert(1)</script>. When injected into HTML elements, the browser displays the characters safely rather than executing them as code.
Is it safe to decode potentially malicious HTML snippets here?
Yes. The decoding engine runs inside an isolated DOMParser document fragment without attaching to the active window DOM tree, ensuring that embedded scripts or event handlers are never triggered during decoding.
Why do single quotes often encode as ' instead of '?
While ' is standard in XML and HTML5, older versions of Internet Explorer (IE8 and earlier) did not support ' in HTML documents. Consequently, ' became the universal safe standard for single quotation marks.
Can this tool encode currency symbols and mathematical notation?
Yes. The engine covers standard HTML5 entities for currencies (€, £, ¥, ¢), Greek letters (α, β, π, Ω), and mathematical symbols (∞, ≠, ≤, ≥, √).
Are my code snippets or text contents uploaded to external servers?
No. All string parsing, regex transformations, and DOMParser entity resolution occur 100% locally within your browser JavaScript memory with zero network requests.
What does the "Encode Every Character" scope do?
It transforms every single alphanumeric character into its numeric entity code. This technique is frequently used by security engineers for payload obfuscation testing and web crawler anti-scraping email protections.