HTML Entity Encoder
Escape text for HTML: & < > " ' to entities, optionally all non-ASCII as named, decimal or hex entities. Prevents broken markup, runs locally.
44 characters · 49 bytes (UTF-8)
0 characters · 0 bytes (UTF-8)
Runs entirely in your browser. Your data is never uploaded.
What is HTML Encode?
Escapes text so it can be placed inside HTML without being interpreted as markup. By default the five significant characters & < > " ' are encoded; you can also convert every non-ASCII character to an entity, using HTML 4 names such as é or numeric references.
How to use HTML Encode
- Type or paste text or HTML into Input.
- Choose Characters to encode: only
& < > " ', or also all non-ASCII characters. - Choose the Entity format: named, decimal or hexadecimal.
- Copy the escaped text from Output.
Example
<a href="x">Tom & Jerry's</a>
<a href="x">Tom & Jerry's</a>
When to use HTML Encode
Use it when inserting user-provided or literal text into HTML, XML-like templates or documentation that shows code. Encoding all non-ASCII characters is only needed for systems that cannot store UTF-8. Note that escaping for HTML text is not enough inside <script>, style or URL attributes – those need context-specific escaping.
How HTML Encode works
The text is processed code point by code point. &, <, >, " and ' are always replaced (' becomes ', which works in HTML 4 and 5). In non-ASCII mode every character above U+007E is replaced by its HTML 4 entity name when one exists, otherwise by a numeric reference; emoji become a single reference such as 😀, not two surrogate halves.
Common Use Cases
- Showing HTML code samples on a web page
- Escaping user input before inserting it into markup
- Putting text into HTML attributes safely
- Producing ASCII-only HTML for legacy email templates
Security Note
Escaping is context-dependent: output from this tool is safe in HTML element content and quoted attributes, not inside <script> blocks or unquoted attributes.
FAQs
Why ' instead of '?
' is not defined in HTML 4, so some older parsers do not recognise it. ' works everywhere.
Do I need to encode é or emoji?
Not if the page is served as UTF-8, which is standard today. Use the non-ASCII option only for ASCII-only systems.
Does this protect against XSS?
It is correct escaping for HTML text and quoted attribute values. Other contexts (JavaScript, CSS, URLs) need their own escaping, and a framework with automatic escaping is the safer choice.