About HTML Encoding
HTML encoding escapes the five characters that have meaning in markup
— <, >, &,
" and ' — so the browser shows them
as literal text instead of interpreting them. That's the whole trick
behind displaying code on a page without it rendering.
If your site renders anything users typed — comments, forum posts, chat messages — escaping it is the first thing standing between you and an XSS mess. It's also exactly what code blocks on blogs and docs sites do under the hood.
Runs entirely in your browser; nothing you paste is uploaded anywhere.
Frequently Asked Questions
Why should I HTML-encode my text?
HTML encoding escapes special characters so the browser renders them as literal text instead of interpreting them as markup. It is essential for displaying code snippets on a web page and for preventing XSS (cross-site scripting) attacks in user-generated content.
Which characters get encoded?
The five characters that have meaning in HTML markup: < (less than), > (greater than), & (ampersand), " (double quote) and ' (single quote). Everything else is left untouched.
What is the difference between HTML encoding and escaping?
They are the same concept: converting a character into its HTML entity so it is displayed as text rather than executed as markup. Encoders like this one do exactly that.
Is my data safe when I encode HTML online?
Yes. The conversion runs entirely in your browser with JavaScript, and your input is never sent to any server.