How to use the HTML encoder
- Choose Encode (text → entities) or Decode (entities → text).
- Paste your content — the result appears instantly.
- Copy the output into your HTML, CMS or code sample.
Why escape HTML?
Characters like <, > and & have special meaning in HTML. If you want to display them rather than have the browser interpret them as markup, you must replace them with entities — <, >, &. This is essential when showing code samples on a page, and it's also a core defence against XSS: escaping user-supplied content before rendering it stops injected markup or scripts from executing.
Benefits
- Escapes &, <, > and optionally quotes into safe HTML entities.
- Decodes entities back to readable characters, including named and numeric forms.
- Includes a reference table of the most common entities.
- Runs entirely in your browser.
Limitations to know
- Escaping output is one defence against XSS, not a complete security strategy.
- It does not sanitise or strip dangerous tags — it escapes everything.
- Context matters: attribute, script and URL contexts need different handling.
Common mistakes to avoid
- Not escaping quotes when the text goes inside an HTML attribute.
- Double-encoding content that was already escaped, so &amp; shows literally.
- Assuming escaping alone makes an application secure.
Alternatives
For web addresses use the URL Encoder & Decoder; to turn Markdown into HTML use Markdown to HTML.
Last updated: August 2026 · Reviewed by the AI Toolbox editorial team.
Frequently asked questions
Is my content uploaded?
No — encoding and decoding run entirely in your browser.
Should I escape quotes too?
Yes, if the text will sit inside an HTML attribute — an unescaped quote would end the attribute early.
Does escaping make my site XSS-safe?
Escaping on output is a key defence, but real security also needs proper validation and context-aware handling. Don't rely on one measure alone.
What's the difference from URL encoding?
HTML entities are for displaying characters in markup; URL/percent-encoding is for making text safe inside a web address.