Search and convert HTML Character References
Search by character, Entity name, Reference, or Unicode, and check Named, Decimal, and Hex notation and bidirectional conversion.
Open HTML Entity List/Character Reference Conversion ToolConclusion: Use character references in HTML source and display the original characters in the browser
You can write < as <, > as >, and & as &. References in source are displayed as their original characters in the browser.
Required characters depend on Context. Do not adopt a practice of unconditionally converting entire strings into Entities.
Examples where HTML syntax conflicts with displayed characters
<p>1 < 2 & 3 > 2</p>Because < can be interpreted as the start of markup and & as the start of a character reference, distinguish the character you want to display from HTML syntax.
Check representative character references
Compare characters commonly used in HTML text.
| Account to check | Confirmation details | judgment |
|---|---|---|
| & | & | Ampersand |
| < | < | Less-than |
| > | > | Greater-than |
| " | " | Quotation mark |
| ' | ' | Apostrophe |
Steps for displaying safely in HTML
- Check the original text to display and the insertion context.
- Use the Tool to select the HTML body and convert it to Named format.
- Place the conversion result in HTML source.
- Check both Page Source and Rendered Text.
Clarify the terminology for HTML entities and character references
They are generally called HTML entities or HTML escaping, but the HTML Standard primarily uses the terms Character Reference, Named Character Reference, and Numeric Character Reference.
| types | Format | example | meaning |
|---|---|---|---|
| Named Character Reference | &name; | < | Represent characters using predefined names |
| Decimal Numeric Character Reference | &# digits; | < | Represent a Unicode Code Point in decimal |
| Hexadecimal Numeric Character Reference | &#x hexadecimal; | < | Represent a Unicode Code Point in hexadecimal |
| Unicode Code Point | U+XXXX | U+003C | A number that identifies a character. It is not HTML source notation itself. |
A named reference may represent a sequence of multiple code points with one name. The tool handles it as an array rather than assuming a single code point.
Separate the required processing by output context
| Context | example | Main response |
|---|---|---|
| HTML Text | <p>USER_INPUT</p> | Output encoding for HTML text or textContent |
| HTML Attribute | <input value="USER_INPUT"> | Quote it and encode for attributes. Keep attribute names fixed as well |
| URL | <a href="..."> | After URL validation and Percent Encoding, also process Attribute Context |
| JavaScript | <script>const x = ...</script> | Processing only for JavaScript contexts, not HTML entities. Avoid direct insertion |
| CSS | <style>...</style> | Consider CSS-context-specific processing and an allowlist of values |
| Allowed HTML | Rich Text Editor | Use sanitization because markup must be retained |
Converting only < to < does not prevent every XSS issue. Review OWASP's context-sensitive output encoding and safe sinks.
Basic steps for investigating and converting character references
- Separate whether the issue occurs in Source, API values, or DOM display results.
- Enter a character, entity name, &name;, or U+XXXX into the list tool.
- Decide whether to encode or decode, then select the HTML body or attribute-value context.
- Compare named, decimal, and hexadecimal results, then copy the canonical semicolon-terminated notation.
- Check the actual template, DOM API, and browser rendering, and verify that encoding is not applied twice at the same layer.
What you can check with the current HTML entity list tool
| Function | Features | Points to note |
|---|---|---|
| Reverse lookup | Search by character, amp, &, U+0026, or numeric character reference. | Check candidates for case-sensitive entity names |
| List search | Partial-match search for character, entity name, reference, Unicode, decimal, hexadecimal, and category | Search built-in data based on the WHATWG list |
| Encode | Select HTML text, double-quoted attributes, or single-quoted attributes, then convert to named, decimal, or hexadecimal form | Convert only the characters required for the context |
| Decode | Restore Semicolon-terminated Named, Decimal, and Hex References only once. | Do not automatically decode double-encoded data multiple times. |
| Details | Display character, named, decimal, hexadecimal, Unicode, aliases, and multiple code points. | Label invisible characters as “invisible.” |
| Copy | Copy character, named, decimal, hexadecimal, Unicode, and conversion results individually. | Display an in-page message if clipboard access fails |
Display conversion results as text; do not execute entered <script> or event attributes within the tool.
Related tools and primary sources
- Check Unicode code points
- Check ASCII codes
- Check Percent Encoding with URL Encoder / Decoder
- Use Base64 Encoder / Decoder to check the difference from binary representation.
- Check JSON syntax with JSON Formatter
- Check before and after encoding with text diff comparison
- Check XML Entity usage with XML Formatter
- WHATWG HTML: Character references
- WHATWG HTML: Named character references
- MDN: Character reference
- MDN: Node.textContent
- MDN: Element.innerHTML
- OWASP: Cross Site Scripting Prevention Cheat Sheet
- W3C: XML 1.0 Fifth Edition
Verify named character reference names and code points against the WHATWG HTML Standard, XSS countermeasures against OWASP, and XML predefined entities against the W3C XML specification.
Display as text.
Writing <div> in Source results in the Text <div> in the Browser.
Even when using code or pre elements in a code example, convert < in the source to character references as needed.
- Enter <div>Hello</div>
- Encode in Named format
- Copy <div>Hello</div>
- Verify display within a code element
Encoding an already converted string again produces &lt;, so check whether it is already encoded.
Frequently asked questions
- Do all characters need to be converted to HTML entities?
- Usually not. Use UTF-8, and convert characters that conflict with HTML syntax or are required by the usage Context when outputting.
- Are &, & and & the same characters?
- Yes. They all represent &. The source representations differ: Named, Decimal, and Hex.
- Is it safe to put the decoded result into innerHTML?
- Not necessarily safe. Markup is restored after Decode, so use textContent for Text display; if HTML is allowed, separately Sanitize it according to requirements.
Writing <div> in Source results in the Text <div> in the Browser.
Even when using code or pre elements in a code example, convert < in the source to character references as needed.
- Enter <div>Hello</div>
- Encode in Named format
- Copy <div>Hello</div>
- Verify display within a code element
Encoding an already converted string again produces &lt;, so check whether it is already encoded.
Frequently asked questions
- Do all characters need to be converted to HTML entities?
- Usually not. Use UTF-8, and convert characters that conflict with HTML syntax or are required by the usage Context when outputting.
- Are &, & and & the same characters?
- Yes. They all represent &. The source representations differ: Named, Decimal, and Hex.
- Is it safe to put the decoded result into innerHTML?
- Not necessarily safe. Markup is restored after Decode, so use textContent for Text display; if HTML is allowed, separately Sanitize it according to requirements.