HTML entities
Escape markup characters so they display as text, or decode them back.
- Runs in your browser — your text is never sent anywhere
- No sign-up, no quotas, free to use as often as you like
How it works
Putting untrusted text into a web page without escaping it is how cross-site scripting happens. Encoding converts the characters a browser treats as markup into entities, so they are displayed rather than executed.
What gets encoded
The five characters that matter: ampersand, less-than, greater-than, double quote and apostrophe. The ampersand must be encoded first, otherwise everything following it is double-encoded.
Decoding
Decoding resolves named and numeric entities back to characters using the browser parser rather than a lookup table, so the full set is handled correctly.
Exactly what is encoded
Encoding replaces five characters: & becomes &, < becomes <, > becomes >, " becomes " and ' becomes '. That is enough to show text safely inside HTML and inside quoted attributes. Accented letters and emoji are left as they are, because UTF-8 pages display them directly.
Decoding
Decoding understands every named entity HTML defines, such as é, — and , plus numeric entities in decimal or hex (é, é), because it uses your browser's own HTML parser.
HTML entities — questions
Does this make my site safe from XSS?
Escaping output is a necessary part of it, but safety depends on escaping in the right context. Use your framework escaping where you have one.
Which characters does it encode?
Ampersand, less-than, greater-than, double quote and apostrophe — the ones a browser would otherwise read as markup.
Is my text uploaded?
No. Encoding runs in the page.