HTML Encode
Escape characters into safe HTML entities.
How to use the HTML Encode
- Paste your text or HTML.
- Copy the escaped entities.
About the HTML Encode
Escaping is what stops text being read as markup. Replace a less-than sign with < and the browser draws the character instead of opening a tag — which is why escaping untrusted input before it reaches a page is the foundation of preventing cross-site scripting. This tool converts the five characters that matter — the ampersand, the angle brackets, the double quote and the apostrophe. Everything else, accented letters and emoji included, is left as it is; UTF-8 handles those without entities.
The ampersand has to be dealt with first, because it starts every entity. Escape the angle brackets first and you would then escape the ampersands you had just introduced, turning < into &lt;. This tool makes a single pass, so each character is replaced once and only once. Named entities and numeric ones are equivalent to a parser — the numeric form simply spells out the code point.
Be clear about what this is for: inspecting and preparing text, not making anything secure. Escaping is context-dependent — output that is safe in HTML body text is not automatically safe inside a script block, an attribute, a URL or a CSS value, and each needs its own rules. Do the escaping in your templating engine, where the context is known. Reverse it with the HTML decoder. It all runs in your browser.
Frequently asked questions
Which characters does it escape?
Exactly five: & < > " and '. Those are the ones that can change how a parser reads your text. Accented characters, symbols and emoji are left untouched, because a UTF-8 page renders them fine and turning them into entities only makes the output bigger.
Does escaping make my site XSS-safe?
No, and it is important not to believe otherwise. Escaping for HTML body text is not sufficient inside a script block, an event handler attribute, a URL or a stylesheet — each context has different rules. Use your framework's context-aware escaping; this page is for inspecting and preparing text.
Why must the ampersand be escaped first?
Because & begins every entity. If you escaped < to < first and then escaped ampersands, you would hit the & you just created and end up with &lt; — visible garbage. A single pass, as used here, avoids the ordering problem entirely.
Why ' instead of '?
Both mean an apostrophe, but ' is a numeric reference that any HTML parser resolves, whereas the named ' came from XML and is not recognised by older HTML parsers. Escapers tend to prefer the numeric form for that reason.
Can I paste real HTML into it?
Yes — that is a common use. Paste markup and you get the escaped source back, ready to display as code on a page rather than being rendered as elements.