How to use HTML Entity Encoder
- Paste the text that will be inserted into HTML.
- Keep quotes enabled for attribute values.
- Choose the entity style your target expects.
- Copy the escaped output.
HTML Entity Encoder features
- Escapes & < > " ' to prevent XSS in element content and attributes
- Named entities (©), decimal (©) or hexadecimal (©) styles
- Optionally encode all non-ASCII characters, or every character
- Named mode falls back to numeric references for characters without a name
- Live output with entity counts
HTML Entity Encoder example
Make user input safe
Input:
<script>alert("Tom & Jerry")</script>Output:
<script>alert("Tom & Jerry")</script>Frequently asked questions about HTML Entity Encoder
Which characters must be escaped to prevent XSS?
At minimum &, <, > and — inside attribute values — the quotes " and '. The tool encodes all five by default, matching PHP's htmlspecialchars with ENT_QUOTES.
Named, decimal or hexadecimal entities?
All three render identically in browsers. Named entities (©) are readable; numeric ones (© or ©) work in XML/XHTML too, where only the five predefined names are guaranteed. The named mode falls back to numeric for characters without a name.
When should I encode non-ASCII characters?
Only when the document might be served without a UTF-8 charset or passes through systems that mangle Unicode. Modern UTF-8 pages can contain Arabic, emoji and accents directly.
Is HTML escaping enough to make user input safe?
It makes text safe inside element content and quoted attributes. Values placed inside URLs, JavaScript or CSS need their own context-specific encoding in addition.
Technical notes
Encoding replaces characters with character references as defined in the HTML Living Standard. Control characters in the U+0080–U+009F range are always written numerically because they have no printable form. The built-in name table covers the ~250 entities in everyday use; anything else is emitted as a numeric reference, which every browser understands.