HTML Entity Encoder
Escape HTML characters online — encode <, >, & and quotes into safe HTML entities to prevent XSS and display code snippets. Free and client-side.
🔒 100% Client-Side Processing
Your data is processed entirely in your browser and never transmitted to any server.
Example
Input
<p>Tom & Jerry</p> Output
<p>Tom & Jerry</p> The structural characters < > & become numeric entities; ordinary letters and spaces pass through unchanged.
0 / 100M Limit
Common Use Cases
Displaying code on web pages
Escape HTML snippets so tutorials and documentation show the markup itself instead of rendering it.
Preventing XSS in output
Encode untrusted user content before inserting it into HTML to verify what safe output should look like.
Embedding markup in attributes
Escape quotes and angle brackets when HTML must live inside an attribute value, JSON string, or XML node.
Frequently Asked Questions
- Which characters does HTML escaping convert?
- The structurally dangerous ones — < > & and quotes — plus non-ASCII characters, each becoming a numeric entity like <. This lets you display code snippets literally and prevents injected markup from executing.
- How does escaping HTML prevent XSS?
- Cross-site scripting works by smuggling <script> or event-handler markup into rendered pages. Escaping converts those characters to inert entities, so user-supplied text displays as text instead of executing as code. Always escape untrusted input at output time. Need to reverse the process? Use our HTML Entity Decoder.
- How do I HTML-escape a string in JavaScript, PHP, or Python?
- JavaScript has no built-in — the common pattern is a small character map or creating a text node and reading its innerHTML. PHP: htmlspecialchars($str). Python: html.escape(str) (from the html module). All three escape the same characters this tool does — paste a value here first to confirm the expected output.
- Is my data private when I use this tool?
- Yes. This tool runs entirely in your browser using client-side JavaScript — nothing you type is transmitted to, logged by, or stored on any server. You can safely process confidential text, tokens, or code.