Which encoding mode should I choose?

Use Essential mode for the vast majority of cases — it prevents XSS and covers every character that's actually a security risk. Modern browsers handle UTF-8 accented letters natively, so Named or Numeric entities only make sense for legacy systems or older email clients that don't render UTF-8 reliably.

Is it safe to encode sensitive data with this tool?

Yes. All processing happens locally in your browser — nothing you type is ever sent to, stored on, or logged by a server.

Are "escaping HTML" and "encoding HTML entities" the same thing?

Yes, they describe the same operation — "escaping" is the verb, "encoding" describes the resulting entity transformation. The terms are used interchangeably in documentation and tooling.

Can I use the output directly in JSX or template literals?

In React, Svelte and Vue, the framework already auto-escapes content inside normal bindings like `{variable}`. Manual HTML encoding is only necessary when you're using `dangerouslySetInnerHTML`, `innerHTML`, or generating raw HTML on the server.

HTML Entity Encoder

Encode text to HTML entities online — escape special characters like <, >, &, and " instantly in your browser. No install needed.

Updated April 2026

Encode Decode

Shift + Enter to Copy · Shift + ← → for tabs

Encoding Mode:

Text to Encode

0 characters

HTML Entities Output

Speed

—

Privacy

Local Only

Size

0 KB

How the HTML entity encoder works

Paste, pick a mode, copy — three steps

1. Paste your text

Type or paste any string into the input field — plain text, a code snippet, or raw HTML.

2. Choose a mode

Essential (`& < > " '`), Named Entities, or Numeric — pick the one that matches your use case.

3. Copy the result

The encoded output updates live as you type — hit Copy or Shift+Enter to send it to your clipboard.

What this HTML entity encoder does

Three encoding modes, one tool

Essential mode

Encodes only & < > " ' — the minimum needed to prevent XSS, and the recommended mode for most cases.

Named entities

Covers accented letters, currency symbols, arrows, Greek letters and math symbols using their official HTML5 entity names.

Numeric entities (`&#…;`)

Converts every non-ASCII character to a decimal reference — maximum compatibility with older or strict parsers.

Runs entirely in your browser

No text is ever sent to a server — encoding happens locally in JavaScript, instantly.

Examples

Input

Encoded output (Essential)

<div>

Tom & Jerry

"hello"

café €10

café €10 (unchanged — only critical ASCII is escaped)

café (Numeric mode)

café

When you'll need this tool

The most common scenarios people use it for

Preventing XSS

Before rendering user-supplied content in HTML, always encode it first — a <script> tag should show up as text, not execute.

Code examples in docs

Display raw HTML tags as readable text inside a <pre> block without the browser interpreting them.

Email templates

Encoding special characters avoids rendering glitches in Gmail, Outlook and Apple Mail.

CMS content input

Makes sure special characters survive the round trip from database to browser without breaking markup.

Sanitizing API responses

Check that your backend's encoding logic actually produces the output you expect before shipping it.

Which mode should you use? Start here

Confusing it with URL encoding

HTML encoding uses entities (< → <); URL encoding uses percent-encoding (< → %3C) — they solve different problems.

Over-encoding everything

Modern UTF-8 pages don't need Named or Numeric entities just for accented letters — Essential mode is enough in most cases.

Relying only on your framework

React, Svelte and Vue auto-escape in normal bindings — manual encoding is only needed with innerHTML or dangerouslySetInnerHTML.

Why encode HTML entities here

Everything runs in your browser via JavaScript — no text is ever sent to, stored on, or logged by a server.

Three modes cover everything from the minimal security baseline (Essential) to maximum compatibility with legacy parsers (Numeric), without needing to memorize which named entity maps to which character.

Frequently asked questions

HTML encoding replaces characters with entities (< becomes <) so they display safely inside a document. URL encoding uses percent-encoding (< becomes %3C) so characters survive transmission inside a URL. Use HTML encoding whenever you're inserting content into HTML markup, not a link.

References

MDN — Character reference

Mozilla's reference with the full list of named HTML character entities.

OWASP — XSS Prevention Cheat Sheet

Security guidance on when and how to apply HTML encoding to prevent cross-site scripting.