HTML Entity Encoder
Escape and unescape HTML entities
What is HTML Entity Encoder?
This HTML entity tool converts characters such as &, <, >, and " into their entity form so that content cannot break the surrounding markup or open an injection hole, and reverses entities back into readable text. You can optionally escape every non-ASCII character as a numeric entity. Conversion happens locally.
How to use HTML Entity Encoder
- 1Choose escape or unescape.
- 2Paste your content and the result is generated instantly.
- 3Enable "escape all non-ASCII" when the content has to travel through an ASCII-only channel.
Frequently asked questions
Does HTML escaping prevent XSS?+
Escaping those five characters is effective baseline protection when you insert untrusted content into an HTML text node. The rules differ once you interpolate into an attribute, a URL, CSS, or JavaScript, so each of those contexts needs its own encoding — or better, use your framework safe binding and let it handle the context for you.
Why must & be escaped first?+
Because every other entity starts with &. If you turn < into < before escaping ampersands, that ampersand gets escaped too and you end up with the double-escaped &lt;. This tool already applies the correct order.
Related tools
All toolsBase64 Encoder & Decoder
Encode and decode Base64, with UTF-8 and URL-safe support
File to Base64
Convert files to Base64 and data URIs — nothing is uploaded
URL Encoder & Decoder
Percent-encode URLs, with separate modes for full URLs and parameter values
Hex to Text Converter
Convert between text and hex with several separator styles
Unicode Escape Converter
Escape and unescape Unicode in three notations
Hash Generator
Compute SHA-1/256/384/512 and MD5 digests