- What are HTML entities and why do I need them?
- HTML entities are special codes used to display reserved or special characters in HTML without breaking the markup. For example, < must be written as < in HTML source, otherwise the browser interprets it as the start of a tag. Entities prevent XSS vulnerabilities and ensure correct rendering.
- What is the difference between named, numeric, and hex entities?
- Named entities use readable names: & for &. Numeric entities use the decimal code point: & for &. Hex entities use the hexadecimal code point: & for &. All three produce identical output in browsers. Named entities are most readable; numeric/hex support any Unicode character.
- When should I encode HTML entities?
- Always encode user-supplied content before rendering it as HTML to prevent XSS (Cross-Site Scripting) attacks. Also encode special characters in email templates, XML documents, and any context where < > & " can cause parsing issues.
- What is the most important HTML entity to know?
- & (ampersand &) is the most critical because it introduces all entities. If you include a literal & in HTML (e.g. in a URL query string), it must be written as &. Failure to encode it can cause rendering errors and is flagged by HTML validators.
- Does HTML entity encoding prevent XSS attacks?
- Encoding the characters &, <, >, ", and ' prevents most reflected XSS attacks in HTML content contexts. However, XSS prevention requires context-aware encoding: URL encoding in href attributes, JavaScript escaping inside <script> tags, and CSS escaping in style attributes. Always use a security-vetted encoding library for production code.
- What is and when should I use it?
- is a non-breaking space — it looks like a regular space but prevents the browser from inserting a line break at that point. Use it to keep two words together (e.g. "10 kg") or to add extra spacing in HTML (though CSS is the preferred way to control spacing).
- Can I decode HTML entities back to plain text?
- Yes. Switch to Decode mode, paste your HTML-encoded text, and the tool converts all entities back to their plain text characters. This is useful when you receive encoded text from an API or database and need the raw string.