HTML entity encoder

Make code samples and user text safe to place inside HTML by escaping the characters that markup uses.

Tier 0 · browser · unlimited

Also encode all non-ASCII characters

Input

Tom & Jerry's <b>bold</b> idea — café ☕

39 characters

Output

Tom &amp; Jerry&#39;s &lt;b&gt;bold&lt;/b&gt; idea — café ☕

Why escape HTML

Browsers read < as the start of a tag and & as the start of a character reference. To show the text <div> on a page, or to put a value containing quotes inside an attribute, those characters must be written as entities: <div>, ". Forgetting this breaks layouts at best; with untrusted input it is how cross-site scripting (XSS) bugs happen.

Turn on all non-ASCII when the text must survive an ASCII-only channel, such as an old email template or a legacy CMS field. Accented letters then become named references like é where one exists, and numeric references like 😀 otherwise.

Worked example

Tom & Jerry's <b>bold</b> idea becomes Tom & Jerry's <b>bold</b> idea. Placed in HTML, it displays exactly as typed, tags and all, instead of making the word bold.

How this works

The encoder replaces the five characters that have a meaning in markup: & with &, < with <, > with >, " with " and ' with '. The numeric form for the apostrophe works in every HTML and XML version. With the non-ASCII option, every character above U+007E becomes a named reference from the WHATWG HTML list when there is a common one, or a hexadecimal numeric reference otherwise. Switch to Decode for the reverse. Everything runs in this tab.

Frequently asked

Does encoding make HTML safe from XSS?

It makes text safe to display as text inside HTML. It is not a sanitizer for HTML you intend to render; use a dedicated sanitizer for that.

Should I use ' or '?

' works everywhere. ' is valid in HTML5 and XML but not in HTML 4.

Do I need to encode accented letters?

Not on UTF-8 pages, which is almost every modern site. Turn on all non-ASCII only for ASCII-only systems.

What is the difference between named and numeric entities?

é and é produce the same é. Numeric references exist for every character; named ones only for some.

Sources

Reviewed Oct 17, 2026 · test vectors fixtures/dev/html-encode/