HTML Entity Encoder/Decoder

Why HTML Entities Exist

HTML uses angle brackets, ampersands, and quotation marks as structural markers in its syntax. The less-than sign begins a tag, the ampersand begins an entity reference, and quotes delimit attribute values. When you need to display these characters as text rather than markup, you must replace them with entity references. Without encoding, the browser would attempt to interpret plain text as HTML structure, breaking the page layout or creating security vulnerabilities.

Beyond reserved characters, HTML entities represent symbols that cannot be typed on a standard keyboard or that might not display correctly across different character encodings. The copyright symbol, trademark symbol, em dash, curly quotes, mathematical operators, and currency symbols all have named entities. Before Unicode became universal, entities were the only reliable way to include these characters in web pages without risking encoding corruption.

Named vs. Numeric Entities

Named entities use human-readable names like & for the ampersand, < for less-than, © for the copyright symbol, and   for a non-breaking space. These are easy to read and remember but only exist for a subset of characters. The HTML5 specification defines over 2,000 named character references, but the vast majority of characters have no named entity.

Numeric entities can represent any Unicode character using its code point. Decimal numeric entities use the format & (ampersand is Unicode code point 38). Hexadecimal entities use &. Since Unicode encompasses over 149,000 characters across 161 scripts, numeric entities provide universal coverage. In practice, most developers use named entities for common characters and numeric entities only when needed for less common symbols.

Common HTML Entities Reference

The five most critical entities for web development are: & for ampersand (&), < for less-than (<), > for greater-than (>), " for double quote ("), and ' for apostrophe ('). Beyond these,   creates non-breaking spaces (useful for preventing line breaks), — produces em dashes, and … creates an ellipsis. Currency symbols include €, £, ¥, and ¢.

Character Encoding History

The need for HTML entities is deeply connected to the history of character encoding. ASCII, designed in the 1960s, supported only 128 characters covering the English alphabet, digits, and basic punctuation. Extended ASCII added another 128 characters but varied by region. ISO 8859-1 (Latin-1) standardized Western European characters. The encoding fragmentation meant the same byte sequence could represent different characters on different systems, causing garbled text known as mojibake.

Unicode solved this by assigning a unique code point to every character in every writing system. UTF-8, the dominant encoding on the web, encodes Unicode characters in one to four bytes while remaining backward-compatible with ASCII. With UTF-8, you can include characters from any language directly in your HTML without entities. However, the five reserved HTML characters still require encoding to prevent markup interpretation, and entities remain essential for XSS prevention.

XSS Prevention Through Proper Encoding

Cross-Site Scripting (XSS) is among the most common web security vulnerabilities. It occurs when user-supplied data is rendered as HTML without proper encoding. An attacker submitting <script>document.cookie</script> in a comment field could steal session tokens from every user who views that page. HTML encoding neutralizes this by converting the script tags into harmless text: <script> displays as literal text instead of executing as code. Every modern web framework includes automatic output encoding, but developers must understand it to avoid accidental bypasses.

Frequently Asked Questions

What are HTML entities?

Text sequences starting with & and ending with ; that represent special characters in HTML. They prevent browsers from interpreting text as markup.

Why do I need to encode HTML entities?

To display reserved characters correctly and to prevent XSS security vulnerabilities from user-generated content. All web applications should encode user input.

What is the difference between named and numeric entities?

Named entities use descriptive names (&amp;) and exist for common characters. Numeric entities use Unicode code points (&#38;) and can represent any character.

What is the difference between HTML encoding and URL encoding?

HTML encoding uses entity references (&lt;) for safe display in web pages. URL encoding uses percent-encoded format (%3C) for safe inclusion in URLs. Different purposes, different contexts.

What is XSS and how does encoding prevent it?

XSS injects malicious scripts into web pages. Encoding converts < and > to &lt; and &gt;, turning executable scripts into harmless display text.