What is the HTML Entity Encoder & Decoder?
Displaying raw code snippets, user input, or special characters on a web page can break your markup or open the door to cross-site scripting (XSS) attacks. The HTML Entity Encoder converts reserved characters such as <, >, &, " and ' — plus unicode symbols like © and € — into their safe entity equivalents like < and ©. Whether you are embedding code samples in a blog post, sanitizing form output, or preparing content for a CMS, correct entity encoding is a fundamental web safety practice.
On BConvert, the encoder and decoder run entirely in your browser — paste sensitive code or user data without worrying about uploads, servers, or accounts. Conversion happens instantly as you type, with options for named entities like & or numeric codes like &, so you get exactly the output format your project needs.
How to use it
- Paste your text — Type or paste any text, HTML snippet, or code sample into the input box on the left side of the tool.
- Choose encode or decode — Select Encode to convert special characters into entities, or Decode to turn existing entities back into readable characters.
- Pick named or numeric — Choose named entities like & for readability, or numeric codes like & for maximum compatibility.
- Review the result — The output updates live as you type, showing exactly how browsers will interpret your converted text.
- Copy the output — Hit the copy button to grab the result and paste it straight into your HTML, template, or code.
Common use cases
- Escape user-generated content before rendering it in the DOM to prevent stored XSS vulnerabilities.
- Embed live code examples inside documentation or tutorial pages without breaking page markup.
- Prepare email newsletter HTML where special characters must survive multiple rendering engines.
- Decode scraped or API-returned content that contains & and other encoded entities.
Tips
- Encode all five reserved characters (< > & " ') whenever injecting strings into HTML contexts.
- Prefer named entities in hand-written HTML; use numeric codes when character-set support is uncertain.
- Remember encoding is not encryption — it is a display-safety mechanism, not data protection.
- Test decoded output in an actual browser to confirm symbols like © render correctly.
Frequently asked questions
What is an HTML entity?
An HTML entity is a text representation of a reserved or special character, written as &name; or &#number;. It lets browsers display characters like < without interpreting them as markup.
When should I encode HTML entities?
Encode whenever text containing <, >, &, or quotes is inserted into HTML — especially user input — to prevent broken markup and cross-site scripting (XSS) vulnerabilities.
What is the difference between encode and decode?
Encoding converts special characters into entities (e.g. < becomes <). Decoding does the reverse, turning entities back into the characters they represent.
Is my data uploaded to a server?
No. Everything runs locally in your browser with JavaScript, so your text is never sent anywhere. You can even disconnect from the internet after the page loads.