About the HTML Entity Encoder
This tool converts characters that have special meaning in HTML — such as &, <, >, and quotes — into their entity equivalents so text can be safely embedded inside HTML markup or attributes without breaking the page structure.
How to use it
- 01Paste text or HTML-adjacent content.
- 02Optionally enable numeric encoding of all non-ASCII characters for maximum compatibility.
- 03Copy the entity-encoded output.
Features
- Escapes &, <, >, double quotes, single quotes and backticks
- Optional numeric-entity encoding of all non-ASCII characters
- Fast, character-by-character conversion with no library overhead
Practical examples
Displaying code snippets
Escape a snippet of markup so it renders as visible text rather than being interpreted as HTML.
Sanitizing user text for templates
Prepare untrusted text for safe inclusion inside a static HTML attribute.
Limitations
- This is a text-escaping helper, not a full HTML sanitizer — it does not parse or validate markup structure.
Privacy
Processing happens entirely in your browser; no text is sent to a server.
Read the full privacy policy for how the site as a whole handles data.
Frequently asked questions
Which characters get escaped by default?
&, <, >, ", ' and ` — the characters most likely to break HTML markup or attribute quoting.
Should I use this for XSS prevention?
Entity-encoding output text is one part of preventing injection issues, but full security requires context-aware escaping in your framework or templating engine.
What does the non-ASCII option do?
It converts every character above code point 127 into a numeric entity, useful for older systems with limited charset support.