HTML Encoder
Encode text for safe use in HTML — the five special characters, or all non-ASCII as numeric entities.
Runs in your browser — your data never leaves your deviceFree, no sign-up
Encoded output
The encoded text will appear here.
How it works
In HTML, the characters <, >, &, " and ' have structural meaning. When you want to display them as literal text — or insert untrusted input into a page safely — each is replaced by its corresponding entity: <, >, &, " and '.
The ampersand is replaced first so that already-encoded input like & is not turned into &amp;.
Features
- Escapes the five HTML-significant characters
- Optional full non-ASCII encoding to numeric references
- Never double-encodes existing entities
- Copy, download and upload actions
- 100% client-side — nothing leaves your browser
How to use
- Paste or type the text you want to encode.
- Optionally tick encode non-ASCII characters if you need pure-ASCII output.
- Press Encode, then copy the result or download it as a text file.
Example
Input: Tom & Jerry <b>"fun"</b>
Output: Tom & Jerry <b>"fun"</b>Frequently asked questions
- Which characters does HTML encoding escape?
- By default the five HTML-significant characters: & < > " ' become & < > " and '. This is the minimum needed to display text safely in HTML and to prevent it from being interpreted as markup. The & character is replaced first, so existing entities in your input are not double-encoded.
- What does the 'encode non-ASCII' option do?
- It converts every character outside the printable ASCII range (U+0000–U+007F) into a numeric character reference like é for é or 🎉 for 🎉. This produces pure-ASCII output that survives misconfigured encodings, older email systems, and other contexts that mangle non-ASCII bytes.
- Is HTML encoding the same as URL encoding?
- No. HTML encoding replaces characters that are special in HTML markup (& < > " '), while URL encoding (percent-encoding) replaces characters that are special in URLs, such as ? & = # and spaces. They solve different problems and are not interchangeable — use the URL Encoder for URLs.
- Does encoding protect me from XSS attacks?
- Encoding is the standard first line of defence for XSS: escaping & < > " ' before inserting untrusted text into HTML makes markup injection impossible. But context matters — attribute contexts, JavaScript strings, and URLs each need the right escaping strategy. Never rely on encoding alone; follow your framework's built-in escaping.
- Is my text sent to a server?
- No. Encoding happens entirely in your browser with JavaScript. Nothing you type is transmitted anywhere — you can verify this in your browser's network inspector.