HTML Entity Encoder Online
Escaping &, <, > and quotes stops browsers from interpreting your text as markup. Use this before pasting code samples into a CMS or embedding user text in HTML.
Runs in your browser — your text is never uploaded or stored.
Raw text or markup
Encoded entities
How to Use
- 1.Paste the text or markup you want to escape.
- 2.Copy the entity-encoded output.
- 3.Paste it into your HTML, CMS field or documentation.
Advertisement
FAQ
Which characters get encoded?
The basic mode escapes &, <, >, double quotes and single quotes — the five that matter for safe HTML output.
Is this enough to prevent XSS?
Entity encoding is one layer. Always escape on the server too and never inject unescaped user input into the DOM.
Need more options?
HTML Entity Encoder / Decoder
Free HTML entity encoder and decoder. Escape <, >, &, quotes and Unicode into HTML entities — or decode entities back to plain text. Runs in your browser.