HTML Entity Encoder

What Is the HTML Entity Encoder?

This tool encodes special characters -- <, >, &, and quote characters -- into their HTML entity equivalents (<, >, &, etc.), so text can be safely embedded inside HTML without being interpreted as markup.

How to Use This Tool

Paste your text. The HTML-entity-encoded version appears instantly, ready to copy into your markup.

Exactly Which Characters Are Converted

The encoder replaces five characters and leaves everything else alone. The ampersand becomes &, the less-than sign becomes <, the greater-than sign becomes >, the double quote becomes ", and the apostrophe (single quote) becomes '. The ampersand is handled first so that entities created by later replacements are not encoded a second time. Accented letters, symbols such as the copyright sign, and emoji are not converted, so they remain as ordinary characters. That is fine for pages served as UTF-8, which is the default for modern sites.

Worked Example

Take the line: Tom & Jerry say "5 < 6" and it's true. After encoding you get: Tom &amp; Jerry say &quot;5 &lt; 6&quot; and it&#39;s true. When this is placed in an HTML page, the browser displays the original wording instead of trying to read the angle bracket as the start of a tag or the ampersand as the start of an entity.

When Encoding Is Necessary

• Showing code samples on a web page. If you want readers to see a tag such as a div element as text, its angle brackets must be encoded, otherwise the browser will render the element instead of displaying it.
• Putting user-supplied text into a page. Encoding characters with special meaning is a basic defence against markup injection in the text content of an element. It is one layer of safe output handling and does not replace the escaping rules for other contexts such as scripts, URLs or CSS.
• Placing text inside an attribute value. The quote characters must be encoded or the attribute ends early. This tool covers both kinds of quotes.
• Writing literal ampersands in URLs inside HTML, for example in a link that carries several query parameters.
• Preparing snippets for documentation, email templates or CMS fields that would otherwise interpret the markup.

Common Mistakes

• Encoding twice. Running already-encoded text through the tool again turns each ampersand in an entity into a further entity, so readers see literal entity codes on the page. Encode raw text just once, and use the decoder tool to undo it.
• Encoding a whole page. If you encode a complete HTML document, the tags themselves become visible text. Encode only the parts that should be shown as text.
• Expecting non-ASCII conversion. If your system needs every non-ASCII character as a numeric entity, this tool will not do that; it only handles the five characters above.
• Assuming it is enough for security. Contexts differ. Text placed inside a script block, a URL, or a style rule needs the escaping method that suits that context. Use your framework's built-in output escaping wherever possible.

Limits

The tool works on plain text only and does not parse markup. It does not know whether a bracket is part of a tag or part of your content, so everything that matches is encoded. Processing happens locally in your browser, and no text is sent anywhere. For very large pastes the page may respond slowly, but typical snippets convert instantly.

Frequently Asked Questions