HTML Entity Encoder Developer
Escape characters so HTML renders them as text instead of markup.
HTML Entity Encoder is a free online tool that escape characters so HTML renders them as text instead of markup. It runs entirely in your web browser using plain JavaScript, so files are processed on your own device and never uploaded to a server. There is no sign-up, no file size limit imposed by the site, no watermark and no paid tier.
- Price
- Free — no account, no quota, no watermark
- Category
- Developer
- Where it runs
- In your browser, on your device
- Files uploaded
- None
- Technology
- plain JavaScript
- Settings
- 1
- Works offline
- Yes, after the first visit
About HTML Entity Encoder
Encoding entities is how you put text into HTML without the browser reading it as markup, and it is the front line against cross-site scripting. Order matters: `&` must be escaped first, or escaping `<` to `<` would then turn its own ampersand into `&lt;` and display the literal text. Five characters need escaping — ampersand, less-than, greater-than, double quote and apostrophe — and this handles them in the correct sequence.
How to use it
- Paste the text you want to run through html entity encoder.
- Set encode all non-ascii too.
The one setting
| Setting | What it does | Default |
|---|---|---|
| Encode all non-ASCII too | On or off. Off by default. | Off |
Under the hood
| Runs on | plain JavaScript — runs the whole thing |
| Controls | Encode all non-ASCII too |
Questions
Is escaping enough to prevent XSS?
In an HTML text node, yes. In other contexts it is not sufficient on its own — inside a `<script>` block, a URL attribute, or a CSS value, different escaping rules apply and HTML entities may not be decoded at all. Context decides.
Why escape the apostrophe?
Because HTML permits single-quoted attribute values. If your template writes an attribute wrapped in single quotes, an unescaped apostrophe in the value closes it early, which is an injection point.