HTML Entity Encoder
Encode special characters into HTML entities for safe display in HTML. Free, instant.
How to use this tool
- Enter text to encode in the fields above.
- Results update instantly as you type — or click Calculate.
- Read your html-encoded and the full breakdown beneath it.
HTML entity encoding converts special characters like <, >, and & into their HTML entity equivalents to prevent XSS and display issues.
How it works
HTML Entity Encoder converts special characters in your text into their corresponding HTML entity codes, making the text safe to embed directly inside HTML documents. Characters like <, >, &, and " have special meaning in HTML; if you paste raw text containing them into a page, the browser may misinterpret it as markup.
Paste any plain text or user-supplied content into the input field and the tool instantly replaces every unsafe character with its named or numeric entity equivalent (for example, < becomes < and & becomes &). The output is a safe string you can drop into an HTML attribute value or element body.
This tool is particularly useful for developers who need to display code snippets, user-generated content, or raw data on a web page without accidentally breaking the page structure or creating cross-site scripting (XSS) vulnerabilities.
Worked example
Safely display a code snippet in HTML
- Copy the code snippet:
- Paste it into the Text to encode field.
- Click Encode.
- Copy the output: <script>alert('hello')</script>
- Paste that output inside a
or
tag in your HTML file.
The browser displays the code as literal text instead of executing it.
Common mistakes to avoid
- Double-encoding already-encoded text: if your input already contains <, encoding it again produces &lt; which will display as < to users instead of <.
- Encoding content that goes into a CSS or JavaScript context: HTML entity encoding is not sufficient for these contexts; use the appropriate escaping for JavaScript strings or CSS values.
- Forgetting to encode content inside HTML attributes: omitting encoding for attribute values (especially href, src, onclick) is a common source of XSS bugs.
Key terms
- HTML entity
- A special text sequence starting with & and ending with ; that represents a character in HTML, such as < for the less-than sign.
- XSS (Cross-Site Scripting)
- A security vulnerability where an attacker injects malicious scripts into web pages viewed by other users. Encoding user input prevents this.
- Character escaping
- The process of replacing characters that have special meaning in a language with a safe representation so they are treated as literal data.
Frequently asked questions
- Why encode HTML entities?
- Encoding prevents browsers from interpreting special characters as HTML tags, protecting against XSS attacks and rendering bugs.