HTML Entity Encoder
Convert characters to HTML entities so they display as text instead of markup. Escapes angle brackets, quotes and ampersands. Free online encoder.
Input
Result
The result appears here as you type.
What this tool is for
To show a tag on a page rather than have the browser run it, the angle brackets must become < and >. That escaping is also the baseline defence against cross-site scripting when user text is placed into a page. This tool applies it to any block of text.
How to use it
- Paste the text or markup you want to display literally.
- Choose whether to escape only the required characters or every non-ASCII character too.
- Copy the escaped output into your HTML.
Frequently asked questions
Which characters actually need escaping?
In body text: & and <. Inside an attribute value, also " and '. The > is not strictly required but is escaped by convention because it costs nothing and avoids edge cases.
Is escaping enough to stop XSS?
It is the right defence for text inserted into HTML body content, and it is not sufficient on its own inside script blocks, URLs or event handler attributes, where the escaping rules differ. Context decides.