How HTML Encoding Works
Paste text to escape markup-sensitive characters into HTML character references. This is useful when displaying source text inside an HTML document. Select the output appropriate to the exact context where it will be inserted.
Characters That Need Escaping
Ampersands and angle brackets need attention in text, and quotes matter in attributes. Escaping protects a character’s textual meaning. It does not transform an entire untrusted document into a safe application.
Named vs Numeric HTML Entities
Named references such as & and numeric references such as & can represent the same character. Browser support and parsing context determine interpretation. Preserve the semicolon to avoid ambiguous parsing.
HTML Encoding and XSS Safety
HTML escaping is context-specific. JavaScript, CSS and URL contexts need their own handling, and a dangerous URL remains dangerous when quoted. Prefer safe DOM text APIs and reviewed sanitizers where rich HTML must be accepted.
HTML Encoding Examples
The literal text <b> becomes <b> so it can be displayed rather than parsed as a bold element. Do not repeatedly encode content that is already escaped unless a second layer is deliberately needed.
More examples and technical details
What HTML Entities Are and Why They Exist
An HTML parser reads a document looking for structure. When it sees a less-than sign it assumes a tag is starting, and when it sees an ampersand it assumes an entity reference is starting. If your content genuinely contains those characters as text, the parser has no way to tell the difference, and your paragraph about "a < b" silently becomes a malformed element.
Entities solve this by giving every problem character an alternative spelling that contains no structural characters. An entity begins with an ampersand, names the character either by keyword or by code point number, and ends with a semicolon. The parser resolves it back to the original character at the moment it builds the text node, so the reader sees exactly what you intended.
The Characters You Must Escape
Five characters do the damage. Two of them, the ampersand and the less-than sign, are dangerous anywhere in an HTML document. The others matter depending on where the text lands.
Order is not optional. If you escape the less-than sign before the ampersand, the ampersand you just introduced gets escaped again and < turns into &lt; which renders as visible text rather than a symbol. Always replace the ampersand first, then everything else.
Escaping and Cross-Site Scripting
Escaping user input before it reaches a page is the primary defence against cross-site scripting. An attacker who can get raw markup into your HTML can run JavaScript in your users' sessions. Encoding removes the ability of the input to change the shape of the document.
The critical subtlety is that escaping is context dependent. There is no single correct encoding, only the correct encoding for the place the value lands:
- HTML body. Escape the five characters above. This is what an HTML encoder does.
- Attribute value. Escape the same set and always quote the attribute. An unquoted attribute can be escaped by a space alone.
- Inside a script block. HTML escaping does not help. You need JavaScript string escaping, and the safest approach is to serialise the value as JSON rather than interpolating it.
- Inside a URL attribute. Percent-encode the value and validate the scheme, since javascript: URLs survive HTML escaping untouched.
- Inside CSS. CSS has its own escaping rules and its own injection vectors. Prefer not to interpolate user data into styles at all.
Named, Numeric, and Hexadecimal Entities
The same character can be written three ways. All three render identically, and the choice is about readability and compatibility.
XML predefines only five names (amp, lt, gt, quot, apos), so anything generating XML, RSS, or SVG should prefer numeric references. Note also that ' was added in HTML5 and is unreliable in very old HTML4 parsers, which is why security libraries tend to emit ' for the apostrophe instead.
HTML Entity Reference Table
Named entities are easier to read, numeric entities work everywhere including XML where only five names are predefined. Both forms always end with a semicolon.
| Character | Named entity | Numeric entity | Description |
|---|---|---|---|
| & | & | & | Ampersand |
| < | < | < | Less than, opens a tag |
| > | > | > | Greater than, closes a tag |
| " | " | " | Double quotation mark |
| ' | ' | ' | Apostrophe or single quote |
| (space) | |   | Non-breaking space |
| © | © | © | Copyright sign |
| ® | ® | ® | Registered trademark sign |
| ™ | ™ | ™ | Trademark sign |
| – | – | – | En dash |
| … | … | … | Horizontal ellipsis |
| € | € | € | Euro sign |
| £ | £ | £ | Pound sign |
| ° | ° | ° | Degree sign |
| × | × | × | Multiplication sign |
Working on something related? Browse every free developer tool on the site, including a HTML decoder, URL encoder, Base64 encoder, and text utilities. Everything runs entirely in your browser, so nothing you paste is ever uploaded.
Frequently asked questions
How do I encode HTML entities?
Paste text in Encode mode and copy the escaped output.
Which characters should be escaped?
Escape markup-significant characters for the destination context, especially ampersands, angle brackets and attribute quotes.
Is HTML encoding the same as URL encoding?
No. HTML uses character references; URL encoding uses percent-encoded bytes.
Does encoding alone prevent all XSS?
No. Correct handling depends on the insertion context, and rich HTML needs sanitization.
Is text uploaded?
No. Input is processed in this browser tab and is not uploaded by the tool. Copy and download are actions you control; ordinary page analytics do not receive tool input.