HTML Entity Encode

HTML Entity Encoder

Paste text or HTML into the box and click Encode into HTML Entities. Characters that have a special meaning in HTML are replaced with entities, so the browser shows them as text instead of treating them as markup. Encoding runs in your browser, and nothing you paste is sent to our server.

Example

Input:

<a href="/search?q=salt&pepper">Search</a>

Output:

<a href="/search?q=salt&pepper">Search</a>

Put the output inside <pre><code> on your page and readers see the original tag as text, not a clickable link.

Which characters need encoding

Only five characters really matter:

The & is the one people forget. Show a URL like example.com/search?lang=en&region=us as plain text on a page and the browser reads &reg as an entity. Readers end up seeing "®ion=us".

For the apostrophe, ' is the traditional choice because ' wasn't part of HTML 4. Every current browser understands both.

Everything else (letters, accented characters, ©, €, emoji) can be typed as-is on any page saved as UTF-8, which today is nearly every page.

When encoding helps

Showing code on a page

Tutorials, documentation and blog posts about HTML all need their examples encoded, or the browser tries to render them. Many editors' code blocks already do this for you. If you paste encoded text into one of those, you'll see < on the page instead of <.

Text inside HTML attributes

Alt text, titles, data attributes and meta tags are all wrapped in quotes. A meta description like content="The "best" free tools" gets cut off at the second quote, and search engines only see "The ". Encoding the inner quotes as " keeps the whole description intact.

Characters that get mangled

Some CMSs, old templates and email systems mangle characters, so é turns into é. A numeric entity like é survives any of them. Entities are also the easiest way to add characters you can't see:

•   keeps "10 km" together on one line.
• ­ marks where a long word may break with a hyphen.

Encoding and XSS

Encoding is the core defense against cross-site scripting (XSS). If text a user submitted is encoded before it goes into a page, a <script> tag shows up as text instead of running. Two things are worth knowing, though.

In a real application, don't do it by hand. Template engines encode output automatically: Blade's {{ }}, Twig, and JSX in React all do. XSS bugs usually appear where someone switched that off, such as {!! !!} in Blade, |raw in Twig, dangerouslySetInnerHTML in React, or innerHTML in plain JavaScript.

HTML encoding only protects HTML. It makes text safe between tags and inside quoted attributes. It doesn't make text safe inside a <script> block, an onclick handler, a style attribute or an href. For example, javascript:alert(1) contains no characters to encode at all. Each of those places needs its own escaping or validation.

This tool is for one-off snippets and for checking what correctly encoded output looks like. It doesn't replace escaping in your code.

FAQ

What's the difference between named and numeric entities?

&, & and & all produce the same &. The first is a named entity; the other two are its Unicode code point written in decimal and in hex.

Named entities are easier to read, but they only exist for some characters. Numeric entities work for any character, even emoji: 😀 is 😀.

Should I encode every character?

No. Encoding ordinary letters makes your source bigger and unreadable, and it doesn't add any security. Some people encode email addresses this way to hide them from spam bots, but scrapers decode entities easily, so it doesn't help much.

Why does my page show & or < instead of the character?

The text was encoded twice, for example once by you and again by your CMS. Run it through HTML Entity Decode once, paste the plain version, and let a single layer do the encoding.

Is HTML encoding the same as URL encoding?

No. HTML entities are for text inside HTML. URL encoding is for text inside a URL, where a space becomes %20 and & becomes %26. For values that go into a link, use the URL Encoder.

Is my text sent anywhere?

No. Encoding happens entirely in your browser, and we never see or store what you paste.