Free HTML Entity Encoder & Decoder Tool

Online HTML Entity Encoder & Decoder: Escape and Unescape Markup

HTML entity encoding is a text sanitization technique that replaces reserved markup characters (such as <, >, and &) with standardized character references, preventing web browsers from misinterpreting raw text as executable HTML elements and neutralizing Cross-Site Scripting (XSS) injection.

In HTML grammar, certain characters are reserved as structural syntax delimiters. If a web browser encounters an unescaped less-than sign (<), its parser switches into a tag-opening state, interpreting subsequent characters as HTML tags rather than visible text. The Urban Mixo HTML Entity Converter encodes and decodes code blocks, symbols, and mathematical notation in real time directly within your browser.

Reserved HTML Entities Reference Matrix

Use this reference table to map reserved syntax delimiters to their corresponding named, decimal, and hexadecimal character entities:

Character Named Entity Decimal Code Hex Code Escaping Context & Purpose
& (Ampersand) &amp; &#38; &#x26; Prevents entity injection; required everywhere
< (Less Than) &lt; &#60; &#x3C; Prevents tag opening (<script>, <iframe>)
> (Greater Than) &gt; &#62; &#x3E; Closes tags and attribute blocks safely
" (Double Quote) &quot; &#34; &#x22; Prevents breaking out of double-quoted attributes
' (Single Quote) &#039; &#39; &#x27; Prevents breaking out of single-quoted attributes

Named Entities vs. Numeric Character References

HTML standards allow two distinct methods for referencing special characters:

  • Named Character References: Human-readable aliases specified by the W3C standard (such as &copy; for © or &mdash; for —). They are easy to remember but some older XML parsers only recognize the 5 core XML entities.
  • Numeric Character References (Decimal & Hexadecimal): References based on exact Unicode code points (such as decimal &#169; or hex &#xA9; for ©). Numeric references provide universal compatibility across strict XML feeds, SVG files, and older mobile rendering engines.

How to Escape HTML Entities in Code

If you need to sanitize user input or format code snippets programmatically in your applications, use these standard native implementations:

1. JavaScript (Browser & Node.js)

// Client-side escaping using regex replacement
function escapeHTML(str) {
return str.replace(/[&<>"']/g, function(char) {
switch (char) {
case '&': return '&amp;';
case '<': return '&lt;';
case '>': return '&gt;';
case '"': return '&quot;';
case "'": return '&#039;';
}
});
}

// Client-side decoding using native DOMParser
function decodeHTML(htmlStr) {
const doc = new DOMParser().parseFromString(htmlStr, 'text/html');
return doc.documentElement.textContent;
}

2. Python 3

import html

# Escape raw strings to safe HTML entities
raw_text = '<script>alert("XSS")</script>'
safe_html = html.escape(raw_text, quote=True)
print(safe_html)
# Output: &lt;script&gt;alert(&quot;XSS&quot;)&lt;/script&gt;

# Unescape entities back to plain text
original_text = html.unescape(safe_html)

3. PHP

<?php
// Standard output escaping for HTML body and attributes
$rawInput = '<script>alert("XSS")</script>';
$safeHTML = htmlspecialchars($rawInput, ENT_QUOTES | ENT_HTML5, 'UTF-8');
echo $safeHTML;

// Decode entities back to raw string
$decoded = htmlspecialchars_decode($safeHTML, ENT_QUOTES);
?>

Frequently Asked Questions

Why is HTML entity escaping critical for web security?

If user-submitted text containing raw <script> tags is rendered directly into a webpage without escaping, the browser's tokenizer executes the code as a legitimate script. Escaping converts < into &lt;, forcing the browser to render the script visually as harmless text without executing it.

What is the difference between HTML entity encoding and URL encoding?

HTML entity encoding targets characters reserved by HTML parsers (like < and >) for safe visual DOM rendering. URL encoding (percent-encoding) targets characters reserved by HTTP protocol specifications (like spaces, ?, and &) to transmit query parameters safely across web addresses.

Does HTML entity encoding protect against XSS inside script tags?

No. Never rely on HTML entity encoding inside a <script> block or inline event handlers (like onclick or href="javascript:..."). Inside script contexts, the browser executes JavaScript directly; HTML character entities will simply be evaluated by the JavaScript engine. Script contexts require strict JSON serialization or hexadecimal JavaScript escaping.

Is my code or text logged or sent to a server?

No. All entity encoding and decoding logic executes 100% locally inside your browser's runtime memory using client-side JavaScript. Your code snippets, passwords, and tokens are never transmitted over a network connection, saved in cookies, or stored on our servers.

Related Web Security & Encoding Guides