HTML entity encoder
This HTML entity encoder replaces characters that have a special meaning in HTML with entities, such as < for <. Web developers and writers use it to show code samples or user text on a page without the browser treating it as markup.
- Runs in your browser
- Free, no account needed
- Copy or download the result
Result
Example
<a title="Tea & coffee">Café</a>
<a title="Tea & coffee">Café</a>
How to use the html entity encoder
- Paste your text into the Text to escape box.
- Choose Non-ASCII characters: Keep Unicode text or Use numeric entities.
- Press Run to escape the text.
- Copy result or Download the escaped text.
How it works
Five characters are always escaped: & becomes &, < becomes <, > becomes >, a double quote becomes " and an apostrophe becomes '.
Use numeric entities writes every character above ASCII as a hex reference, so é becomes é.
The output is meant for an HTML text node or a quoted attribute value.
This is not an HTML sanitizer. It does not clean up HTML you want to keep, and it does not escape text for JavaScript, CSS or URLs.
An unpaired surrogate, which is half of an emoji left over after bad copying, causes an error.
Everything runs in your browser. Your input is not uploaded or stored.
Questions and answers
Does escaping HTML prevent XSS?
Escaping helps against cross-site scripting (XSS) when you place untrusted text inside HTML text or a quoted attribute. It is not enough inside script tags, style blocks, event handler attributes or URLs, which need their own escaping.
Why convert non-ASCII characters to numeric entities?
Most modern pages handle Unicode fine. Numeric entities help when a file or system only accepts plain ASCII characters.
Why is the apostrophe written as '?
The numeric form ' works in every version of HTML, while the named form ' is not supported by some older HTML parsers.
Is my text sent anywhere?
No. Escaping runs in your browser, and you can turn the result back with the HTML entity decoder.