PopularHot
JSON Formatter
JSON Formatter for developers — instant, offline-style and privacy-safe.
DeveloperOpen Tool
HTML Encoder
Escape the five HTML-special characters — ampersand, less-than, greater-than, double quote and apostrophe — so text shows as text instead of becoming markup. Runs in your browser.
Loading HTML Encoder…
Your browser is preparing the tool. It runs 100% locally.
Quick Answer
Paste text and the tool replaces the five characters that have special meaning in HTML — ampersand, less-than, greater-than, double quote and apostrophe — with their character references, so a browser shows them as literal text instead of treating them as tags or attributes. The apostrophe uses the numeric reference 39 (the universally safe form). Everything else, including accents and emoji, is left as-is. It runs entirely in your browser.
What the HTML Encoder Does
Type or paste text and you get a version that is safe to drop inside an HTML page. The ampersand becomes its amp entity, the less-than and greater-than signs become their lt and gt entities, the double quote becomes its quot entity, and the apostrophe becomes the numeric reference 39 — so a snippet of code or markup displays as written rather than being parsed.
These five characters are the ones that can break HTML or open a cross-site-scripting hole. Encoding them is the standard way to show user-supplied or code text on a page without the browser mistaking it for real markup.
How It Works
The tool scans your text for the five special characters and swaps each for its character reference. The less-than sign is the most important — it is what opens a tag — so neutralising it (and the other four) stops the browser from interpreting your text as elements, attributes or entities.
It uses named references for four of them and a numeric reference for the apostrophe. The named apostrophe entity is not part of older HTML, so the numeric form (reference 39) is used instead, which every browser understands. Characters beyond these five — letters, accents, emoji — are left exactly as they are.
Data source & conversion logic
- Scan for the five characters. Look through the text for ampersand, less-than, greater-than, double quote and apostrophe.
- Encode the ampersand first. Replace the ampersand so the entities created for the others are not themselves re-encoded.
- Replace the others. Swap less-than, greater-than and double quote for their named references.
- Use a numeric reference for the apostrophe. Encode the apostrophe as numeric reference 39, the form valid in all HTML.
The five characters it escapes
ampersand → amp entity
less-than → lt entity
greater-than → gt entity
double quote → quot entity
apostrophe → numeric reference 39Only these five are changed. Accents, emoji and every other character are left untouched, which is valid in a UTF-8 page.
Privacy
The text is escaped in your browser with a small character replacement; nothing is uploaded, so you can safely encode private content.
Encoding is for safe display, not security by itself. It stops text from being parsed as markup, but it is not a substitute for proper, context-aware output encoding across a whole application.
Technical Details
| Escapes | ampersand, less-than, greater-than, double quote, apostrophe |
|---|---|
| Ampersand | named amp reference |
| Angle brackets and quote | named lt, gt, quot references |
| Apostrophe | numeric reference 39 |
| Other characters | left as-is (accents and emoji included) |
| Purpose | show text as text; help prevent XSS |
| Where it runs | In your browser — nothing uploaded |
Standards & references
- HTML character references — special characters are written as entities — an ampersand, a name or number, and a semicolon — so the browser shows the character instead of acting on it.
- The five XSS-critical characters — less-than, greater-than, ampersand, double quote and apostrophe are the characters that define tags, attributes and entities; encoding them prevents the bulk of cross-site-scripting in HTML content.
- Numeric apostrophe — the named apostrophe entity is not valid in HTML 4, so the numeric reference 39 is used; it works everywhere, including older HTML and XML.
Accuracy & Limitations
It escapes exactly five characters. That is the right set for text placed in normal HTML content, but other contexts need more: a value inside an HTML attribute, a URL, JavaScript or CSS each have their own encoding rules, and this tool does not cover them.
It does not encode accents, symbols or emoji into entities. On a UTF-8 page that is correct — those characters display fine as themselves — so the output is intentionally minimal, not a full entity conversion of every non-ASCII character.
The ampersand is encoded first on purpose. If it were not, the entities created for the other characters could be re-encoded, turning an amp reference into a broken double-encoded string.
Encoding is not a complete XSS defence. It neutralises the five structural characters in HTML content, but safe applications also validate input and encode correctly for every output context. Treat this as one layer, not the whole shield.
Run text through twice and it double-encodes: the ampersands in the entities from the first pass get escaped again, so an amp reference becomes a longer, wrong string. Encode once.
Real-World Use Cases
Showing code on a page
Display HTML or markup as text in a tutorial or doc without it rendering.
Escaping user input
Make user-supplied text safe to insert into HTML content.
Pasting into templates
Prepare a snippet that contains special characters for an HTML file.
Preventing broken markup
Stop a stray angle bracket or ampersand from breaking a page.
When to use it — and when not to
Good for
- Showing code or markup as text
- Escaping the five HTML-special characters
- Making user text safe for HTML content
- Quick, minimal entity encoding
Not the best choice for
- Encoding for HTML attributes, URLs, JS or CSS contexts
- Converting every accent or symbol to an entity
- A complete cross-site-scripting defence on its own
- Decoding entities back to text
Need to turn entities back into characters? Use the HTML decoder. Putting text in a URL? Use the URL encoder. Building a secure app? Pair this with input validation and context-aware encoding throughout.
Frequently Asked Questions
Which characters does it escape?
Five: the ampersand, less-than sign, greater-than sign, double quote and apostrophe. These are the characters that have structural meaning in HTML, so encoding them lets the text show as text.
Why these five characters?
They define HTML — the less-than sign opens a tag, the ampersand starts an entity, quotes wrap attribute values. Left raw, they can break the page or allow cross-site scripting; encoded, they display as themselves.
Why is the apostrophe a number and not a name?
The named apostrophe entity is not valid in HTML 4, only in XML and HTML5. The numeric reference (number 39) works in every browser and version, so it is the safe choice.
Does it encode accents and emoji?
No, and that is intentional. On a UTF-8 page accented letters and emoji display correctly as themselves, so only the five structural characters need encoding.
Is HTML encoding the same as encryption?
No. It is a display measure, fully reversible, that stops text from being read as markup. It provides no secrecy.
Does this fully protect against XSS?
It handles the five characters for text in HTML content, which prevents most HTML-context attacks. A complete defence also validates input and uses the right encoding for attributes, URLs, JavaScript and CSS.
Why is the ampersand encoded first?
Because the entities created for the other characters themselves contain an ampersand. Encoding the ampersand first prevents those new entities from being re-encoded into a broken string.
What if I encode the text twice?
It double-encodes. The ampersand in each entity from the first pass is escaped again, so an amp reference grows into a longer, incorrect one. Encode once and decode once.
Where do I use the output?
Inside HTML content — between tags — where you want the characters to display literally. For an attribute value or a URL, use the encoding made for that context instead.
Will it change my letters or numbers?
No. Only the five special characters are touched; letters, digits, spaces and other symbols pass through unchanged.
Is my text uploaded?
No. The encoding happens entirely in your browser; nothing is sent anywhere.
How do I get the original text back?
Run the encoded text through the HTML decoder, which turns the references back into their characters.
References
Escapes exactly the five HTML-special characters — ampersand, the two angle brackets, double quote and apostrophe — using named references for four and the numeric reference 39 for the apostrophe (valid in all HTML); other characters, including accents and emoji, are left as-is, and it is honest that this is one XSS layer, not a complete defence.
Related Tools
Popular
JSON Validator
JSON Validator for developers — instant, offline-style and privacy-safe.
DeveloperOpen Tool
Popular
Base64 Encoder
Base64 Encoder for developers — instant, offline-style and privacy-safe.
DeveloperOpen Tool
Popular
Hash Generator
Fast, free Hash Generator that runs entirely client-side in your browser.
DeveloperOpen Tool
Popular
UUID Generator
Fast, free UUID Generator that runs entirely client-side in your browser.
DeveloperOpen Tool
Trending
CSS Minifier
Fast, free CSS Minifier that runs entirely client-side in your browser.
DeveloperOpen Tool
Ready to try the HTML Encoder?
It is free, private and runs entirely in your browser — no sign-up, no uploads, no limits.