HTML Encoder
Escape the characters that would otherwise be interpreted as markup, so your text displays exactly as written.
Your data stays on your device
Input — Text or markup
- characters
- 0
- lines
- 0
- size
- 0 B
Output — Escaped
- characters
- 0
- lines
- 0
- size
- 0 B
Options
Prevents & from becoming & on already-escaped text.
About this tool
Five characters change meaning inside HTML: the angle brackets, the ampersand, and both quote marks. Displaying a code sample or any untrusted text without escaping them means the browser tries to render the content as markup.
Minimal mode escapes exactly those five, which is what you want for readability. Full mode additionally converts every non-ASCII character into a numeric entity, which is occasionally required by legacy systems that cannot be trusted with UTF-8.
How to use this tool
- Paste the text or markup you want to escape.
- Choose minimal escaping or full non-ASCII entity encoding.
- Press Encode.
- Copy the escaped output into your HTML.
Key features
- Minimal escaping of &, <, >, " and '
- Full mode converting every non-ASCII character to a numeric entity
- Named entities used where they are more readable
- Existing entities optionally left untouched to avoid double escaping
- Line-by-line processing preserved
- Character counts before and after
Example
Input — Text
<a href="/x">Go</a>Output — HTML entities
<a href="/x">Go</a>Good to know
- Escaping is context-specific. HTML escaping does not make a value safe inside a script block, a style block or a URL attribute.
- This is a display helper, not a security control. Server-side output encoding and a content security policy remain necessary.
- Double-escaping already-escaped text produces visible &lt; sequences unless you enable entity preservation.
Frequently asked questions
Which characters actually need escaping?
In text content, & and < are mandatory. Inside attribute values you also need the quote character used to delimit the attribute. Escaping all five is the safe habit.
Does this protect against XSS?
Correct contextual escaping is a core defence, but a browser-side tool is not a security boundary. Encode on the server where the output is produced.
Why is my & showing as &amp;?
The text was already escaped and got escaped again. Enable the option that preserves existing entities.
When do I need full entity encoding?
Rarely. Only when a downstream system cannot handle UTF-8 reliably. Modern pages should declare UTF-8 and use characters directly.
Your data stays on your device
Your data is processed locally in your browser and is not uploaded to our server. This page keeps working after you go offline, because there is nothing to send.