HTML Entity Encode
Escape text to safe HTML entities instantly and for free.
This tool runs entirely in your browser. Your files are never uploaded to a server.
What this tool does
Replaces the five characters that have special meaning in HTML — `<`, `>`, `&`, `"`, and `'` — with their named character entities (`<`, `>`, `&`, `"`, `'`), so the text can be placed inside HTML markup without being parsed as tags or attributes.
How to use it
Type or paste text into the input box; the escaped output appears automatically below it. Copy it with the copy button and paste it directly into your HTML source or template.
Worked example
Encoding `<script>alert('hi')</script>` produces `<script>alert('hi')</script>` — the angle brackets and single quotes are neutralized, so a browser displays the literal text instead of running it as a script tag.
Why this matters for security
Escaping untrusted text before inserting it into an HTML page is one of the standard defenses against cross-site scripting (XSS): if user-supplied text is dropped into a page unescaped, characters like `<` can let an attacker inject working markup or scripts instead of plain text.
What isn't escaped
Ordinary letters, digits, and punctuation such as `. , ! ? -` pass through unchanged, since they have no special meaning in HTML — only the five reserved characters are converted, keeping the output as close to the original as possible.
Limitations
This escapes text for safe display inside HTML element content and attribute values; it does not sanitize CSS, JavaScript, or URLs, which have their own, different escaping rules, and it does not validate or parse the HTML you paste it into.
Privacy
Encoding runs entirely in your browser via client-side JavaScript; the text you enter is never uploaded to a server or stored.
Frequently Asked Questions
- What does HTML entity encoding do?
- It replaces special characters such as <, >, &, and quotation marks with their HTML entity equivalents so the text can be displayed safely inside HTML without being interpreted as markup.
- How do I use this tool?
- Type or paste your text into the input box and the HTML-escaped output appears instantly — copy it and paste it into your HTML.
- Why would I need to escape HTML entities?
- It prevents user-supplied or raw text from breaking your page's layout or being misused for cross-site scripting (XSS) when displayed on a webpage.
Related Tools
HTML Entity Decoder
Decode HTML entities like & and < back into readable text.
URL Encode
Percent-encode text or URLs instantly and for free.
JSON Formatter
Format, validate and beautify JSON for free.
Base64 Encode
Encode text or strings to Base64 instantly and for free.
HTML Formatter
Format and indent HTML code into a clean, readable structure directly in your browser.
HTML Minifier
Minify HTML by removing unnecessary whitespace and comments for a smaller output.