HTML Encoder
Escape HTML special characters into safe entities.
Was this tool helpful?
Thanks for the feedback!
The HTML Encoder escapes the five characters that have special meaning in HTML, so text can be placed inside a web page and displayed literally instead of being read as markup. Bloggers use it to show code samples, and developers use it to check how user input should look once it is safely escaped.
The five characters it replaces
| Character | Becomes |
|---|---|
& | & |
< | < |
> | > |
" | " |
' | ' |
Everything else, including accented letters, Hindi text, emoji and ₹, passes through unchanged. That is correct for any page served as UTF-8, which is nearly every modern site. The apostrophe uses the numeric ' because the named ' was not part of HTML 4 and older software may not recognise it.
Worked example
Input:
<p title="Q&A">Tom's "₹500" offer</p>Output:
<p title="Q&A">Tom's "₹500" offer</p>Placed inside a <pre><code> block on your blog, the encoded version shows readers the paragraph tag itself, attribute and all, instead of a formatted paragraph. Notice the size: 37 characters became 77, so encode only where the text will be read as HTML, not in data you store or send elsewhere.
A quick way to check a snippet: if the encoded output contains no bare < or " characters and every ampersand starts an entity, it can be dropped between any two tags safely.
When encoding is the right defence
If a comment, name or search term typed by a visitor is inserted into a page unescaped, a string like <script> becomes part of the page, which is the basis of cross-site scripting (XSS). Escaping these five characters neutralises that for two places: text between tags, and attribute values wrapped in double or single quotes. Other places need different treatment:
- Inside JavaScript strings, use JSON-style escaping, for example with the JSON String Escaper.
- Inside URLs and query parameters, use percent-encoding.
- Unquoted attributes such as
value=textcan be broken with a space, so always put quotes around attribute values.
In real applications, let your template engine do this automatically: Laravel's Blade {{ }}, Django templates and React all escape output by default. This tool is best for one-off snippets, documentation and checking what the escaped form should look like.
Avoid encoding twice
The ampersand is always escaped, even when it already begins an entity, so running the encoder on & already gives &amp; already, and the page will display "&". Encode raw text only once. If you need named codes for accented letters and symbols as well, the HTML Entities Converter does that, and the HTML Decoder reverses either one. The encoding runs in your browser.