HTML Entity Encoder

HTML entities are how the web safely represents characters that have meaning in markup. When you need to display a '<' as text, or safely echo user input into a page, escaping it into an entity is non-negotiable — it is a core defense against XSS and broken layouts.

OpenToolLab's HTML entity tool escapes the key characters — ampersand, less-than, greater-than, double quote, and single quote — to their named entities, with an optional numeric-entity mode for maximum compatibility. The decoder works in reverse, turning entities like &lt; and &amp; back into their literal characters.

Conversion is instant and live as you type, making the tool ideal for preparing user-generated content for safe rendering, debugging templating issues, or cleaning up exported data. And it runs entirely in your browser, so even sensitive markup never leaves your device.

Why does escaping matter so much? Consider a comment form. If a user submits '<script>alert(1)</script>' and you insert that string into your page without escaping, the browser treats it as markup and executes it. That is a stored XSS vulnerability — the single most common way attackers compromise web applications. Escaping converts every angle bracket into an entity so the script renders as harmless text on screen while never being executed. This encoder does that transformation in one click.

The five characters that always need escaping are the ampersand, the less-than and greater-than signs, and double and single quotes. The ampersand is especially sneaky: it is itself the start of every entity, so a raw & can corrupt the entities that follow it. That is why escaping order matters — the encoder handles it correctly so your output is always valid HTML.

Named versus numeric entities is a practical choice. Named entities like &copy; and &trade; are human-readable and widely supported, which makes them great for hand-maintained templates. Numeric entities like &#169; and &#8482; work in every context, including environments with limited character support, and are commonly used by server-side templating engines in PHP, Java, and JavaScript. This tool offers both modes so you can match whatever your stack expects.

Server-side developers will recognize the same logic in PHP's htmlspecialchars, Java's StringEscapeUtils.escapeHtml, and JavaScript's textContent assignment. This tool produces the same result, which makes it a convenient cross-check when you are building a template or sanitizing output in a language you do not use every day.