HTML Encoder

Escape HTML special characters to display code safely.

HTML Encoder

Developer tool running locally in browser

Input

Ad Space (auto) — Configurable via NEXT_PUBLIC_ADSENSE_CLIENT

What does HTML Encoder do?

Convert &, <, >, " and ' into their HTML entities so text displays literally instead of being parsed as markup. This is the core defence against cross-site scripting when showing user-supplied content.

How to Use HTML Encoder

1
Paste your text or markupAnything you want shown literally.
2
Choose the encoding depthBasic escaping, or everything non-ASCII too.
3
Copy the resultPaste it into your page source.

Key Features

Escapes the five characters that matter: & < > " and apostrophe
Optional numeric encoding of every non-ASCII character
Named entity option where a standard name exists
Live preview showing how the encoded text renders
Round-trips exactly through the HTML decoder

Frequently Asked Questions

Which characters must be escaped in HTML?

Ampersand and angle brackets always. Inside an attribute value, quotes and apostrophes must be escaped too. Escaping all five is the safe default.

Does escaping prevent XSS?

Contextual escaping is the foundation of XSS prevention, but the correct escaping differs by context — HTML body, attribute, JavaScript string and URL each need different treatment. This tool handles HTML context. Use your framework’s built-in escaping in application code.

What is the difference between named and numeric entities?

Named entities such as & are readable but only exist for a defined set. Numeric entities such as & work for any character. Both are equally valid HTML.

Do I need to escape non-English characters?

Not if your page is served as UTF-8, which it should be. Numeric encoding is only useful for legacy systems or contexts that strip non-ASCII bytes.

100% Data Privacy

Input is processed in your browser and never transmitted. That said, treat any web page as untrusted for live production secrets — rotate anything you paste anywhere.