HTML Entity Encoder & Decoder
Rendered, so you can check it
Why escaping exists
A browser cannot tell the difference between a less-than sign you meant as text and one that starts
a tag. Escaping removes the ambiguity: < is unmistakably the character, never
the beginning of markup. That single distinction is what keeps user-supplied text from becoming
executable code.
The four that matter
&becomes&— and it must be escaped first, or you double-escape everything else.<becomes<>becomes>"becomes"— essential inside an attribute.
Where escaping alone is not enough
HTML escaping protects text in the body of a page. A value going into a script block, a URL, or a style attribute needs different escaping entirely — and using the wrong one is the most common way a site that "escapes everything" still has a hole.
Share this tool with friends
Free to use, no sign-up, works on any phone.
Frequently Asked Questions
Four: & < > and ". Everything else is optional. Escaping those four is what stops text being read as markup, which is the whole point — and a fifth, the apostrophe, matters inside single-quoted attributes.
It is necessary but not sufficient. Escaping for HTML text does not protect a value placed inside a script block, a URL or a style attribute, each of which needs its own escaping. Treat this as one layer, not the answer.
Not any more. With a UTF-8 page — which yours should be — é and नमस्ते work as they are, and entities just make the source harder to read. The "everything" mode exists for legacy systems that still need it.
Both mean an apostrophe. The numeric form is safer because &apos; was not in HTML 4 and old versions of Internet Explorer do not recognise it, so the numeric one is used here.
Usually double encoding — text that was escaped twice, so &amp;lt; needs two passes. Decode again and it resolves.