HTML Entity Encoder
Escape HTML special characters. Full named-entity support, optional ASCII-only.
EncodeHTMLClient-sideFree to use
0 / 500,000
Try It Out
How to use
- Paste your text. Any text with <, >, &, quotes, or unicode.
- Pick options. Named entities or numeric; ASCII-only or minimal.
Common use cases
- Escaping user input before rendering
- Cleaning CMS content
- Preparing email templates
Frequently asked questions
- What is HTML entity encoding and when do I need it?
- HTML entity encoding replaces characters with special meaning in HTML (< > & " \') with safe escape sequences (< > & " '). Use it whenever untrusted text might end up between HTML tags or inside attributes, to prevent XSS and broken markup.
- What is the difference between named, decimal, and hex entities?
- Named entities use a memorable name (©, &, —). Decimal entities use a numeric Unicode code point (©), and hex entities use the hex form (©). Browsers render all three identically; named entities are easier to read but only ~250 are defined in HTML5.
- What does the ASCII-only mode do?
- It encodes every non-ASCII character (including emoji and accented Latin) as a numeric entity. The result is safe to paste into any tool that only accepts plain ASCII, at the cost of larger output.
- Should I HTML-encode user input on the server or in the browser?
- Both. Encode on the server when storing or templating into HTML to prevent stored XSS. Encode again in the browser if you build HTML strings client-side from untrusted input. Use this tool to verify the expected output.
- Does this encoder run in the browser?
- Yes. The mapping uses the he library locally, so the input never leaves your machine.
Related tools
How to use
- Paste your text. Any text with <, >, &, quotes, or unicode.
- Pick options. Named entities or numeric; ASCII-only or minimal.
Common use cases
- Escaping user input before rendering
- Cleaning CMS content
- Preparing email templates
Frequently asked questions
- What is HTML entity encoding and when do I need it?
- HTML entity encoding replaces characters with special meaning in HTML (< > & " \') with safe escape sequences (< > & " '). Use it whenever untrusted text might end up between HTML tags or inside attributes, to prevent XSS and broken markup.
- What is the difference between named, decimal, and hex entities?
- Named entities use a memorable name (©, &, —). Decimal entities use a numeric Unicode code point (©), and hex entities use the hex form (©). Browsers render all three identically; named entities are easier to read but only ~250 are defined in HTML5.
- What does the ASCII-only mode do?
- It encodes every non-ASCII character (including emoji and accented Latin) as a numeric entity. The result is safe to paste into any tool that only accepts plain ASCII, at the cost of larger output.
- Should I HTML-encode user input on the server or in the browser?
- Both. Encode on the server when storing or templating into HTML to prevent stored XSS. Encode again in the browser if you build HTML strings client-side from untrusted input. Use this tool to verify the expected output.
- Does this encoder run in the browser?
- Yes. The mapping uses the he library locally, so the input never leaves your machine.