HTML Entities Converter
Convert special characters to HTML entities for safe display on web pages. Encode and decode symbols, accents and reserved characters.
HTML Entities Converter
Mode:
🔤 What are HTML Entities?
HTML entities are codes that represent special characters in HTML. They are necessary to correctly display characters that have special meaning in HTML.
📖 Common examples:
• < represents <
• > represents >
• & represents &
• " represents "
• © represents ©
• á represents á
💡 Use: Essential when displaying HTML code on web pages or when working with special characters that can break HTML formatting.
What are HTML Entities?
HTML entities are special codes that represent characters that have special meaning in HTML or that are not available on the keyboard. They start with & and end with ; (named format) or use numeric codes.
Why Use Them?
- Security: Prevent HTML/JavaScript injection attacks (XSS)
- Correct display: Show < > & literally
- Compatibility: Ensure rendering on all browsers
- Special characters: Display symbols not available on keyboard
Most Common Entities
< or <> or >& or &" or "' or ' or  © or ©® or ®€ or €™ or ™Portuguese Accents
Use Cases
- XSS Security: Sanitize user input before displaying
- Source code: Display HTML examples on web pages
- HTML emails: Ensure compatibility across email clients
- XML/RSS: Escape special characters in feeds
- Meta tags: Use quotes in HTML attributes
- Mathematics: Symbols like ∑ ∫ √ ≠
Security Example (XSS)
⚠️ Malicious user input:
<script>alert('Hacked!');</script> ✅ After conversion to entities (safe):
<script>alert('Hacked!');</script> The code is displayed as text, not executed!
Entity Formats
Named
More readable: ©, €
Not all characters have names
Numeric
Universal: ©, €
Work for any Unicode character
UTF-8 vs Entities
💡 Modern Practice: With UTF-8 as the default charset, accents and
common symbols can be used directly. Use entities mainly for:
• Reserved HTML characters (< > &)
• XSS Prevention
• Mathematical/special symbols
Useful Symbols
🔒 Security: Always escape user output in web applications to prevent XSS attacks. Use functions specific to your language/framework.