About the HTML Entity Encoder
Escape text so it shows up literally inside HTML instead of being read as markup, or decode text full of &, ' and back to plain characters. Encode only the five characters HTML requires, or every non-ASCII character too, for systems that only accept ASCII.
How to use it
- Choose Encode or Decode.
- Paste your text or HTML.
- Copy the result.
Example
- Input
- <a href="x">Tom & Jerry</a>
- Result
- <a href="x">Tom & Jerry</a>
Questions
Which characters must be escaped in HTML?
& and < always; > for safety; " and ' inside attribute values. Encoding these five makes text safe to place in HTML content and quoted attributes.
Does escaping prevent XSS?
Escaping is the main defence when you put text into HTML content or a quoted attribute. It is not enough inside <script>, style or URL attributes, which need their own encoding.
Named or numeric entities?
Both work in every browser. Numeric entities (©) cover every character; named ones (©) are easier to read.