HTML Encoder

Escape text into HTML entities so markup and user content display literally instead of executing.

Encoders & DecodersRuns in your browserFree, no sign-up

Options

Encode

Use named entities

& instead of & where a name exists.

Hexadecimal numeric entities

& instead of &.

Text or HTML

Encoded entities

Output appears here as you type.

Ctrl + Enter to run

About the HTML Encoder

Encoding converts characters that mean something to an HTML parser into entities, so `<script>` becomes text on the page instead of a script that runs. That substitution is the boundary between displaying user content and executing it, which makes it the foundation of cross-site scripting defence.

Use it whenever text you did not write ends up in markup — a code sample, a comment, a value pasted into a template. Note that entity encoding is for HTML context specifically; the same string placed inside a URL, a JavaScript literal or an attribute needs that context's own escaping instead.

Frequently asked questions

Is HTML encoding enough to prevent XSS?

It is the right defence for one context — text inside an element body or a quoted attribute — but not universally. Content going into a <script> block, an inline event handler, a URL attribute or a CSS value each needs its own escaping rules. Escaping for the wrong context is a well-known way to produce a vulnerability that looks defended.

Which characters actually need escaping?

Five: & < > " and '. Escaping the whole non-ASCII range is available but rarely useful on a UTF-8 page — it inflates the output several times over for no security benefit, since a UTF-8 document can carry é and 日本語 directly.