HTML Entity Encoder
Make text safe to put inside HTML, so characters like < and & are shown instead of read as code.
Runs in your browser · No uploads
Your browser is too old to run this tool. Please update it, or use a current version of Chrome, Edge, Firefox or Safari.
- Nothing leaves your device
- No server-imposed size limits
- No sign-up, no watermark
- Free
How to encode HTML entities
- Paste your text or code.
- Choose whether to escape quotes and how to write non-ASCII characters.
- Copy the encoded result.
Which characters?
- Always: & < > (and " ' for attribute values).
- Characters such as é, © or emoji only need encoding if the page isn't UTF-8. Choose named (é), decimal (é) or hexadecimal (é) entities.
Frequently asked questions
Is this enough to prevent XSS?
Escaping is the right step for text placed inside HTML elements and quoted attributes. Inside JavaScript, URLs or CSS, other rules apply; use your framework's escaping for those.
Is my text uploaded?
No. Everything happens in your browser, and the page is blocked from uploading anything.