Which characters must be encoded?

Minimum: & " ' (in attributes). In practice, encode & always, and quotes when in attribute context. Other characters (©, é) work in UTF-8 but encoding is safer for compatibility.

Should I use named or numeric entities?

Named (&) is more readable. Numeric (&) works for any character and has better compatibility. For common characters use named, for Unicode beyond ASCII use numeric or just UTF-8.

Does HTML encoding prevent all XSS?

It prevents XSS in HTML text content. For attributes, you also need attribute-safe encoding. For JavaScript contexts, JSON encoding. For URLs, URL encoding. Context matters - use appropriate encoding for each.

HTML Entities Encoder

Guide & TutorialOffline

Encode special characters to HTML entities

Encode special characters to HTML entities instantly with our free online HTML encoder tool. This encoder helps web developers and content creators convert characters like &, <, >, and quotes into safe HTML entities to prevent XSS attacks and display special characters correctly. Simply paste your text and get HTML-encoded output in real-time.

Input Text

0 characters

HTML Encoded Output

Encoded Characters

& → &

< → <

> → >

" → "

' → '

About HTML Entities Encoder

HTML encoding converts special characters to their HTML entity equivalents, preventing XSS attacks and ensuring characters display correctly in HTML. Characters like <, >, &, and quotes have special meaning in HTML and must be encoded when displaying user content.

How It Works

The encoder replaces characters that have special HTML meaning with named or numeric entities. < becomes <, > becomes >, & becomes &, and quotes become " or '. This prevents browsers from interpreting user input as HTML markup.

Technical Details

HTML entities: < (<), > (>), & (&), " ("), ' or ' ('). Numeric entities (<) work for any Unicode character. Named entities are more readable but not all characters have names. Always encode user input before inserting into HTML.

Common Use Cases

XSS Prevention

Encode user input to prevent script injection.

<script>alert("xss")</script> → safe display

Display Code Snippets

Show HTML code as text without browser rendering.

Email Templates

Safely include dynamic content in HTML emails.

CMS Content

Encode user-submitted content for safe display.

Code Examples

JavaScript HTML Encoding

javascript

// Simple encoder
function htmlEncode(str) {
  return str
    .replace(/&/g, '&amp;')
    .replace(/</g, '&lt;')
    .replace(/>/g, '&gt;')
    .replace(/"/g, '&quot;')
    .replace(/'/g, '&#39;');
}

// Using DOM (browser)
function htmlEncode(str) {
  const div = document.createElement('div');
  div.textContent = str;
  return div.innerHTML;
}

// React does this automatically
<div>{userInput}</div>  // Safe - React encodes

Replace order matters: & first, or you'll double-encode. React/Vue auto-encode in JSX/templates.

Python HTML Encoding

python

import html

# Encode special characters
safe = html.escape('<script>alert("xss")</script>')
# '&lt;script&gt;alert("xss")&lt;/script&gt;'

# With quote encoding (for attributes)
safe = html.escape('value="test"', quote=True)
# 'value=&quot;test&quot;'

# Django templates auto-escape
{{ user_input }}  # Automatically encoded

html.escape is the standard library solution. Django/Jinja2 templates auto-escape by default.

Tips & Best Practices

Always encode user input before inserting into HTML
Use framework auto-escaping (React, Vue, Django templates)
Encode & first to avoid double-encoding other entities
Different contexts need different encoding (HTML, attribute, JS, URL)
Test with actual XSS payloads to verify protection

Common Mistakes to Avoid

Encoding & after other characters (double-encodes)
Using HTML encoding in JavaScript context (wrong encoding)
Trusting sanitization over encoding (sanitization can miss cases)
Decoding then forgetting to re-encode

When to Use This Tool

Use HTML encoding whenever inserting dynamic content into HTML pages. Essential for preventing XSS vulnerabilities and safely displaying user-generated content.

Frequently Asked Questions

HTML encoding is for displaying in HTML (<, &). URL encoding is for including in URLs (%20, %26). Different character sets, different purposes. A URL in an HTML href needs both: href="page?q=a%26b" with & in the HTML properly handled.

// Simple encoder function htmlEncode(str) { return str .replace(/&/g, '&') .replace(/</g, '<') .replace(/>/g, '>') .replace(/"/g, '"') .replace(/'/g, '''); } // Using DOM (browser) function htmlEncode(str) { const div = document.createElement('div'); div.textContent = str; return div.innerHTML; } // React does this automatically <div>{userInput}</div> // Safe - React encodes

import html # Encode special characters safe = html.escape('<script>alert("xss")</script>') # '<script>alert("xss")</script>' # With quote encoding (for attributes) safe = html.escape('value="test"', quote=True) # 'value="test"' # Django templates auto-escape {{ user_input }} # Automatically encoded