HTML Entity Encoder

Runs in browser Encoding

Convert text into HTML-safe output using named or numeric entities, with the option to encode all non-ASCII characters.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

What are HTML entities?

HTML entities are escape sequences that let a page show characters HTML would otherwise interpret as markup: &lt; for <, &amp; for &, &quot; for a double quote, plus named and numeric references for any Unicode character (&copy;, &#169;, &#x00A9;). Encoding untrusted text this way before putting it in a page is what stops it from becoming script.

Security note: Text that reaches a page unencoded is the root of cross-site scripting. Encode on output, for the context it lands in (HTML body, attribute, JavaScript, URL) — decoding user input to "clean" it is not a defence.

Entity encoding makes text safe in element content and quoted attributes; a value inside a URL, JavaScript or CSS needs that context’s own encoding.
<p>Part 1:Tom &amp; Jerry</p>
<input value="Part 2:Say &quot;hi&quot;">
<a href="/search?q=Part 3:tom%26jerry">
<script>let q = "Part 4:…";</script>
<style>p { color: Part 5:… }</style>
  1. 1Element contentThe tool’s output is enough here.Pass
  2. 2Quoted attribute valueEnough while “Encode quotes” stays on, as it is by default. An unquoted attribute is not covered.Pass
  3. 3Value inside a URLNeeds percent-encoding as well: tom&jerry becomes tom%26jerry.Caution
  4. 4Inside JavaScriptThe browser does not decode entities here; needs JavaScript escaping instead.Caution
  5. 5Inside CSSThe browser does not decode entities here; needs CSS escaping instead.Caution

Simplified: one line per output context. Slots 1 and 2 show this tool’s output with its default settings.

How to use HTML Entity Encoder

  1. Paste the text that will be inserted into HTML.
  2. Keep quotes enabled for attribute values.
  3. Choose the entity style your target expects.
  4. Copy the escaped output.

HTML Entity Encoder features

  • Escapes & < > " ' to prevent XSS in element content and quoted attribute values
  • Named entities (&copy;), decimal (&#169;) or hexadecimal (&#xA9;) styles
  • Optionally encode all non-ASCII characters, or every character
  • Named mode falls back to numeric references for characters without a name
  • Live output with entity counts

HTML Entity Encoder example

Make user input safe

Input:

<script>alert("Tom & Jerry")</script>

Output:

&lt;script&gt;alert(&quot;Tom &amp; Jerry&quot;)&lt;/script&gt;

Frequently asked questions about HTML Entity Encoder

Which characters must be escaped to prevent XSS?

At minimum &, <, > and — inside attribute values — the quotes " and '. The tool encodes all five by default, matching PHP's htmlspecialchars with ENT_QUOTES.

Named, decimal or hexadecimal entities?

All three render identically in browsers. Named entities (&copy;) are readable; numeric ones (&#169; or &#xA9;) work in XML/XHTML too, where only the five predefined names are guaranteed. The named mode falls back to numeric for characters without a name.

When should I encode non-ASCII characters?

Only when the document might be served without a UTF-8 charset or passes through systems that mangle Unicode. Modern UTF-8 pages can contain Arabic, emoji and accents directly.

Is HTML escaping enough to make user input safe?

It makes text safe inside element content and quoted attribute values, and nowhere else. A value placed in a URL also needs percent-encoding, and a link or image address that a user supplies must be limited to http or https: no encoding stops a javascript: URL. Inside a <script> or <style> element the browser does not decode entities at all, so a value there needs JavaScript or CSS escaping instead.

Technical notes

Encoding replaces characters with character references as defined in the HTML Living Standard. Control characters in the U+0080–U+009F range are always written numerically because they have no printable form. The built-in name table covers the ~250 entities in everyday use; anything else is emitted as a numeric reference, which every browser understands.

References

  • HTML Living StandardWHATWGThe HTML language, including named character references (entities) and the parsing rules browsers follow.
  • Cross Site Scripting (XSS)OWASP FoundationWhat cross-site scripting is, its reflected / stored / DOM variants and how encoding prevents it.