HTML Entity Encode

Paste HTML or text below and click Encode to escape special characters as HTML entities. All processing happens locally in your browser.

Copied!

What is HTML Entity Encoding?

HTML entity encoding converts special characters into their HTML entity equivalents to prevent them from being interpreted as HTML markup. For example:

  • < → &lt;
  • > → &gt;
  • & → &amp;
  • " → &quot;
  • ' → &#39;

This prevents XSS attacks and ensures text displays correctly in HTML documents.

The scope setting is the one that matters. Encoding only what breaks HTML keeps the text readable and is right for anything a person will edit again. Encoding everything above ASCII produces output that survives a pipeline stuck on a single-byte character set, at the cost of a much larger file. The invisible option is worth a run whenever a heading looks wrong for no reason: a non-breaking space or a zero-width joiner that arrived with a copy and paste shows up as a named reference you can actually see.

Related tools

HTML Entity Decode URL Encode Unicode Escape / Unescape

Is the markup fighting you?

Escaped entities, mangled encodings and content that renders one way in the CMS and another on the page usually mean something in the pipeline is guessing. We build front ends and the publishing path behind them, so what you write is what a visitor sees.

Talk to us about your site

Frequently Asked Questions

What is an HTML entity?
It is a way of writing a character so a browser reads it as text rather than as markup. &amp; stands for an ampersand and &lt; for a less-than sign, which is what stops a stray angle bracket from being taken as the start of a tag.
Which characters actually have to be encoded?
In ordinary text only the ampersand and the less-than sign are strictly required, and the greater-than sign by convention. Inside an attribute you also need the quote mark that closes it. Everything else is optional, which is why the default here encodes exactly that set and leaves the rest readable.
Named or numeric references?
Named ones are easier to read and are what a person editing the file will recognise. Numeric ones work for every character, including the many that have no name, and never depend on the parser knowing a name. Hexadecimal is the form you will see in specifications and in most generated output.
Why would I encode everything above ASCII?
Because something in the chain cannot be trusted with anything else. An old export, a mail template, a system that declares one character set and sends another. Encoding above ASCII makes the file survive that at the cost of size, and it is the wrong choice for anything a person edits again.
What does the invisible characters option find?
Non-breaking spaces, zero-width joiners, soft hyphens and the other characters that arrive with a copy and paste and then break a layout for no visible reason. Turning it on renders them as references you can see, which is usually the fastest way to find the one that is causing trouble.