What is the HTML Encoder?
When you put text into HTML, characters like <, > and & have special meanings: a < starts a tag, and & starts an entity. The HTML Encoder replaces them with entities such as < and &, so code samples, user comments and email templates display exactly as written instead of being interpreted as HTML.
Escaping quotes keeps text safe inside attribute values. You can also convert accented letters, Indian scripts, ₹ and emoji into named (é) or numeric (₹) entities for systems that only handle plain ASCII.
How to use it
- Paste the text or code to encode.
- Keep “Escape quotes” on if the text goes inside an HTML attribute.
- Choose how to handle non-ASCII characters: keep, named, decimal or hex.
- Copy the encoded HTML.
Example
<p class="note">Tom & Jerry</p>
<p class="note">Tom & Jerry</p>
Features
- Safe by default. Escapes & < > " and ', the characters that can break or inject HTML.
- Non-ASCII options. Keep characters as they are, or write them as named, decimal or hex entities.
- Full Unicode. Emoji and characters outside the basic plane become a single correct entity.
- Code samples. Paste HTML, XML or JSX to show it as text in a blog post or documentation.
- Round trip. Send the result to the HTML Decoder to check it.
Frequently asked questions
Which characters must be escaped in HTML?
Always & and <, and > for safety. Inside attribute values, also the quote character used around the value (" or '). Everything else, including emoji and Indian scripts, is fine as-is in a UTF-8 page.
Does this protect against XSS?
Escaping text before inserting it into HTML is the core defence against cross-site scripting in element content and quoted attributes. It is not enough inside script elements, URLs or CSS, which need their own escaping.
Named or numeric entities?
Both display the same. Named entities like é are easier to read; numeric ones like é work for every character, including those without a name, such as ₹ (₹).
Is my text uploaded?
No. Encoding happens in your browser.
Last updated · Free, no sign-up, runs in your browser.