HTML Encoder
Encode text for safe use in HTML: the five special characters, or all non-ASCII as numeric entities.
Runs in your browser, your data never leaves your deviceFree, no sign-up
Encoded output
The encoded text will appear here.
How it works
In HTML, the characters <, >, &, " and ' have structural meaning. When you want to display them as literal text (or insert untrusted input into a page safely), each is replaced by its corresponding entity: <, >, &, " and '.
The ampersand is replaced first so that already-encoded input like & is not turned into &amp;.
Features
- Escapes the five HTML-significant characters
- Optional full non-ASCII encoding to numeric references
- Never double-encodes existing entities
- Copy, download and upload actions
- 100% client-side, nothing leaves your browser
How to use
- Paste or type the text you want to encode.
- Optionally tick encode non-ASCII characters if you need pure-ASCII output.
- Press Encode, then copy the result or download it as a text file.
Example
Input: Tom & Jerry <b>"fun"</b>
Output: Tom & Jerry <b>"fun"</b>Frequently asked questions
- Which characters does HTML encoding escape?
- By default the five HTML-significant characters: & < > " ' become & < > " and '. This is the minimum needed to display text safely in HTML and to prevent it from being interpreted as markup. The & character is replaced first, so existing entities in your input are not double-encoded.
- What does the 'encode non-ASCII' option do?
- It converts every character outside the printable ASCII range (U+0000–U+007F) into a numeric character reference like é for é or 🎉 for 🎉. This produces pure-ASCII output that survives misconfigured encodings, older email systems, and other contexts that mangle non-ASCII bytes.
- Is HTML encoding the same as URL encoding?
- No. HTML encoding replaces characters that are special in HTML markup (& < > " '), while URL encoding (percent-encoding) replaces characters that are special in URLs, such as ? & = # and spaces. They solve different problems and are not interchangeable, so use the URL Encoder for URLs.
- Does encoding protect me from XSS attacks?
- Encoding is the standard first line of defence for XSS: escaping & < > " ' before inserting untrusted text into HTML makes markup injection impossible. But context matters, since attribute contexts, JavaScript strings, and URLs each need the right escaping strategy. Never rely on encoding alone; follow your framework's built-in escaping.
- Is my text sent to a server?
- No. Encoding happens entirely in your browser with JavaScript. Nothing you type is transmitted anywhere, and you can verify this in your browser's network inspector.