HTML encode

Convert special characters to HTML entities so they display as text in HTML.

Paste content to embed in HTML without triggering tags or breaking attributes.

Text
Encoded

How it works

& becomes &amp;, < becomes &lt;, > becomes &gt;, quotes become entity forms.

Use this before inserting user text into templates.

XSS

Encoding user input for HTML context is part of defense in depth; still follow framework defaults.

Context matters

Entity escaping for HTML text is different from URL or JS string contexts.

Common questions

All Unicode?
Non ASCII characters pass through unchanged here; only HTML-significant ASCII is escaped.
Attribute context?
Quotes are escaped for attribute safety; validate your full pipeline.
Decode?
Use the HTML decode tool paired with this one.
Server side?
Prefer encoding at render time in your stack; this page is for quick checks.