The Five Characters That Break HTML
HTML gives special meaning to a handful of characters, so putting them into a page as-is either breaks rendering or opens a security hole. Encoding replaces them with named entities the browser displays literally:
| Character | Entity | Role in HTML |
|---|---|---|
& | & | Starts every entity — must always be encoded first |
< | < | Opens a tag |
> | > | Closes a tag |
" | " | Delimits attribute values |
' | ' | Delimits attribute values (single-quoted) |
Example: <div class="hello">World & "Friends"</div> encodes to <div class="hello">World & "Friends"</div> — paste that into a page and the browser shows the markup as text instead of rendering a div.
Encode and Decode Modes
Switch modes with the toggle at the top; conversion happens live as you type. Encode replaces the five special characters above. Decode is more general: it resolves any entity the browser knows — named ( , ©, é), decimal (é), and hexadecimal (é) — so it cleans up entity-littered text scraped from web pages or CMS exports in one pass.
Why This Matters: Displaying Code and Preventing XSS
- Showing code on a page: to display an HTML snippet in a blog post or docs, it must be entity-encoded, otherwise the browser renders it instead of showing it.
- XSS prevention: user input echoed into HTML without encoding lets an attacker inject
<script>tags. Encoding on output turns the attack into harmless visible text. It's the single most important output-escaping rule in web development. - Fixing double-encoded text: if you see
&lt;in rendered output, the text was encoded twice. Run it through decode until it stabilizes.
HTML Encoding vs. URL Encoding
They solve different problems and aren't interchangeable: HTML entities make text safe inside markup; percent-encoding makes text safe inside URLs. A value that goes into a link's href query string needs the URL encoder; the visible link text needs this tool. Everything here runs entirely in your browser — nothing you paste is sent to a server. Also useful alongside: the Markdown to HTML converter for generating markup and the Base64 tool for data URIs.