What is HTML?
HTML encoding converts characters that have special meaning in HTML — such as <, >, &, double quotes and apostrophes — into their HTML entities (for example <, >, &). This makes the characters display as text instead of being interpreted as markup, and it is a key defense against cross-site scripting (XSS) when showing user-supplied content. This tool converts text into safe HTML entities instantly in your browser.
Security tip: HTML-encoding user input before putting it on a page is a core defense against XSS. Encoding runs locally in your browser.
How HTML works
HTML encoding swaps characters that the browser would treat as markup for named or numeric entities:
&becomes&(encoded first so other entities are not double-encoded).<becomes<and>becomes>.- Double quote becomes
"and apostrophe becomes'. - The browser then renders each entity as the literal character instead of interpreting it as a tag or attribute.
How to use
- Enter or paste your text in the input box.
- The HTML-encoded result appears instantly in the output.
- Click Copy to use the encoded value.
Examples
| Input | HTML-encoded |
|---|---|
<b>bold</b> | <b>bold</b> |
Tom & Jerry | Tom & Jerry |
5 < 10 | 5 < 10 |
say "hi" | say "hi" |
Options explained
- Named vs numeric entities — Characters can be encoded as named entities (&lt;) or numeric ones (&#60;).
- Encode all non-ASCII — Optionally encode every non-ASCII character as a numeric entity for maximum compatibility.
Common uses
- Escaping user-generated content before displaying it (XSS prevention).
- Showing code or HTML snippets as text on a web page.
- Safely embedding special characters in HTML attributes.
- Preparing content for HTML emails and templates.
Frequently asked questions
Why encode HTML?
To display special characters literally and to prevent XSS by stopping user input from being treated as markup.
What does & mean?
It is the HTML entity for the & character.
How do I decode HTML entities?
Use the HTML Decode tool to turn entities back into normal characters.
Does HTML encoding stop all XSS?
It is a key defense for content placed in HTML, but full XSS protection also requires correct handling in attributes, URLs and scripts.