HTML entities are essential for preventing XSS (Cross-Site Scripting) attacks and correctly displaying special characters in web pages. Any time you display user-generated content in HTML, you must encode it first. This guide shows you how to encode HTML entities online safely and efficiently.

What are HTML Entities?

HTML entities are character sequences that represent special characters which have meaning in HTML syntax. The most important ones to encode are:

Character | Entity    | Name
----------|-----------|------------------
<         | &lt;      | Less than
>         | &gt;      | Greater than
&         | &amp;     | Ampersand
"         | &quot;    | Double quote
'         | &#39;     | Single quote / apostrophe
/         | &#x2F;   | Forward slash (extra safety)

Step-by-Step: How to Encode HTML Entities Online

Open the tool — Visit the HTML Entity Encoder.
Paste the content to encode — Enter any text containing <, >, &, or quotes.
Click Encode — Get the HTML-safe version instantly.
Copy and use safely — The encoded output is safe to insert into HTML without breaking layout or enabling XSS.

Real-World Use Cases

1. Displaying User-Generated Content Safely

Never insert user input directly into HTML. Always encode first:

# Dangerous — XSS vulnerability!
username = '<script>alert("hacked")</script>'
html = f"<p>Welcome, {username}!</p>"
# → <p>Welcome, <script>alert("hacked")</script>!</p>

# Safe — encode user input before inserting into HTML
import html
safe_username = html.escape(username)
html_output = f"<p>Welcome, {safe_username}!</p>"
# → <p>Welcome, &lt;script&gt;alert("hacked")&lt;/script&gt;!</p>

2. Displaying Code Samples in HTML

When showing code examples on a web page, encode HTML tags to prevent them from being parsed:

<!-- Wrong: HTML tags inside pre will be parsed -->
<pre>
  <div class="container">Hello</div>
</pre>

<!-- Correct: entities prevent parsing, show raw code -->
<pre>
  &lt;div class="container"&gt;Hello&lt;/div&gt;
</pre>

3. Encoding Email Template Content

HTML emails often contain user data or dynamic content that must be entity-encoded:

# Python: safe HTML email generation
import html

def render_greeting_email(username: str, message: str) -> str:
    safe_name = html.escape(username)
    safe_msg = html.escape(message)
    return (
        "<html><body>"
        f"<h1>Hello, {safe_name}!</h1>"
        f"<p>{safe_msg}</p>"
        "</body></html>"
    )

Common Mistakes to Avoid

Encoding content that's already in a script or style block — HTML encoding only applies to HTML text content and attribute values. JavaScript strings inside <script> tags need JavaScript escaping, not HTML encoding.
Forgetting to encode in HTML attributes — User data in attributes like href, title, or data-* must also be encoded to prevent attribute injection attacks.
Double-encoding — If content is already encoded, encoding again produces &amp; instead of &. Decode first if the content might already be encoded.
Relying on HTML encoding as the only XSS prevention — Also use Content Security Policy (CSP) headers and output context awareness (HTML vs JS vs CSS).

Related Tools

URL Encoder — Encode special characters for safe use in URLs
Base64 Encoder — Encode binary data for HTML data URIs
Markdown Preview — Preview Markdown that will be rendered as HTML

How to Encode and Decode HTML Entities Online: Step-by-Step Guide

What are HTML Entities?

Step-by-Step: How to Encode HTML Entities Online

Real-World Use Cases

1. Displaying User-Generated Content Safely

2. Displaying Code Samples in HTML

3. Encoding Email Template Content

Common Mistakes to Avoid

Related Tools

Ready to try it?

Related Articles

How to Encode Base64 Online: A Complete Guide

How to Format JSON Online: Step-by-Step Tutorial

How to Decode JWT Online in 3 Steps

How to Minify CSS Online: Save File Size Fast