Skip to content
codevory

HTML Encoder

Escape text for safe use in HTML: <, >, &, quotes and, if you want, every non-ASCII character.

HTML Encoder: the tool

Type or paste text to escape its HTML special characters.

Input

Escaped HTML

The result appears here.

How to use HTML Encoder

  1. Paste the text or markup you want to display literally.
  2. The five characters that HTML treats specially are replaced by entities: & < > " and '.
  3. Turn on Encode non-ASCII to also write every accented letter, symbol and emoji as a numeric reference such as &#233;.
  4. Copy the result into your page, template or attribute value.

Example

A link containing quotes and ampersands, escaped so it can be shown as text on a page.

Input
<a href="/search?q=a&b" title='Tom & Jerry'>Café</a>
Encoded
&lt;a href=&quot;/search?q=a&amp;b&quot; title=&#39;Tom &amp; Jerry&#39;&gt;Café&lt;/a&gt;
Encoded, non-ASCII as numeric references
&lt;a href=&quot;/search?q=a&amp;b&quot; title=&#39;Tom &amp; Jerry&#39;&gt;Caf&#233;&lt;/a&gt;

About this tool

In HTML, < starts a tag and & starts an entity. To show those characters as text, or to put untrusted text into a page without letting it become markup, they must be escaped as &lt; and &amp;. Inside an attribute value, the quote that delimits the value must be escaped too, which is why the double and single quotes are included.

Escaping on output is the main defence against cross-site scripting (XSS) when you build HTML from text. Use the escaping function of your template engine or framework in real code. This tool is for the cases where you need the escaped text by hand: documentation, emails, CMS fields and test data.

The optional numeric references are useful when the target cannot be trusted to keep UTF-8 intact, such as some legacy email systems.

Characters escaped

CharacterEntityWhy
&&amp;Starts every entity
<&lt;Starts a tag
>&gt;Ends a tag
"&quot;Ends a double-quoted attribute value
'&#39;Ends a single-quoted attribute value

Frequently asked questions

Does HTML encoding make user input safe?

It prevents text from being read as markup in the place where you put it. Different places need different escaping: HTML text, attribute values, URLs, JavaScript and CSS each have their own rules. Use the escaping built into your framework for the right context.

Why is the apostrophe &#39; and not &apos;?

&apos; is not defined in HTML 4 and was missing from old browsers. &#39; works everywhere, so it is the safe choice.

Should I encode non-ASCII characters?

Usually not. Pages served as UTF-8 display them correctly. Numeric references are only needed when the text passes through something that may corrupt UTF-8.

Will already encoded text be encoded again?

Yes. The & of an existing entity is escaped, so &amp; becomes &amp;amp;. That is correct when you want to show the entity as text. To reverse the encoding, use the HTML decoder.

Is the text uploaded?

No. Encoding runs in your browser.

More developer tools