HTML Entity Encoder

Escape HTML special characters safely.

Free HTML entity encoder. Convert < > & quotes (and optionally all non-ASCII characters) into HTML entities so text displays safely in pages, in your browser.

Loading tool…

If the tool stays on this message, make sure JavaScript is enabled, then reload the page.

About HTML Entity Encoder

Type the characters for an HTML tag into a page and the browser doesn't display them, it tries to build the element. That's why HTML entities exist: they let you show the characters <, >, and & as text instead of having them swallowed as markup. Encoding is the quiet step behind every tutorial page that displays code samples correctly.

This encoder offers two scopes. Basic covers the markup characters, angle brackets, ampersands, and quotes, which is all most pasting-into-HTML tasks need. Full goes further and converts every non-ASCII character (accented letters, symbols, emoji) into numeric entities, useful for pages served without a UTF-8 charset or legacy systems that mangle anything beyond plain ASCII.

Choose your scope, paste the text, click encode, and copy the result. A word of caution for developers: encoding helps prevent broken markup and plays a role in XSS defense, but proper output escaping depends on context, what is safe in HTML body text isn't automatically safe inside attributes or scripts. Use your framework's escaping for security-critical paths.

How to use HTML Entity Encoder

  1. Choose Basic or Full encoding scope.
  2. Paste your text and click Encode.
  3. Copy the entity-escaped output.

Why use this tool?

  • Basic mode for markup chars, Full for all non-ASCII
  • Prevents broken markup when pasting into HTML

Tips for best results

  • Basic mode handles nearly all CMS and blog pasting, reach for Full only with legacy non-UTF-8 systems.
  • Always encode user-supplied text before injecting it into HTML; it's the first line of defense against broken pages and XSS.
  • Context matters for security: body-text encoding isn't sufficient inside attributes, URLs, or script blocks.
  • If your page declares UTF-8 (most do), you rarely need to encode accented characters. Save Full mode for exceptions.
  • Encode once: double-encoding turns & into &amp;amp;, which displays literally instead of as &.

Frequently asked questions

Basic vs Full, which do I need?
Basic covers < > & and quotes, which is enough for most HTML. Full also encodes accented characters and symbols as numeric entities.
Is my text uploaded?
No. Encoding happens locally in your browser.
How do I decode entities?
Use the HTML Entity Decoder tool.
Does encoding make my content safe from XSS?
It helps for HTML body context, but it's not a complete solution. Proper XSS defense also depends on where the content lands, attributes, scripts, and URLs need context-aware escaping, ideally from your framework.
When would I use Full encoding?
When the destination can't reliably handle UTF-8, legacy systems, old email templates, or pages without a charset declaration. Modern UTF-8 pages rarely need it.

Related tools

HTML Entity DecoderTurn HTML entities back into characters. HTML FormatterPretty-print messy HTML with clean indentation. HTML to TextStrip HTML down to readable text. URL EncoderPercent-encode URLs or query values safely.