Home/Tools/Text & developer utilities
HTML Entity Encoder
The five characters that must be escaped, and why.
The five characters that matter
HTML gives special meaning to a handful of characters. To display them as text rather than have the browser act on them, they have to be escaped.
- < becomes < — otherwise it starts a tag
- > becomes >
- & becomes & — otherwise it starts an entity
- " becomes " — needed inside attributes
- ' becomes ' — needed inside single-quoted attributes
The ampersand is the one people forget, and it is the most important. Escape the angle brackets but not the ampersand and you produce output that is still broken, because < written literally will be decoded by the browser.
This is a security boundary, not a formatting nicety
Unescaped user input rendered into a page is how cross-site scripting happens. Someone submits a comment containing a script tag, the page prints it raw, and the browser runs it — in every other visitor's session.
Escaping those five characters is the defence. It turns the tag into visible text rather than an instruction.
Use this to understand and inspect escaping, not as the escaping step in an application. Real code should use its framework's escaping, which is context-aware: what is safe inside an attribute differs from what is safe inside a script block or a URL, and a single escape function is not sufficient for all of them.
Named, numeric and Unicode
There are over two thousand named entities — , ©, — — plus numeric forms like — that work for any character.
In a UTF-8 document, which is essentially all of them now, you do not need entities for accented letters, symbols or emoji. Write them directly. The only ones that remain genuinely necessary are the five above, plus where a non-breaking space is wanted and would otherwise be invisible in the source.
Common uses
- Showing code examples on a web page.
- Understanding why output is rendering instead of displaying.
- Reading escaped text out of a database or an API response.
- Checking how something was escaped.
Questions people ask
Which characters must be escaped in HTML?
Less-than, greater-than, ampersand, and both quote marks inside attributes. The ampersand is the one people forget and the most important.
Why does escaping matter for security?
Because unescaped user input rendered into a page is how cross-site scripting works. Escaping turns a script tag into visible text rather than an instruction.
Do I still need entities for accented characters?
No. In a UTF-8 document you can write them directly. Only the structural characters genuinely need escaping.
Should I use this in my code?
No. Use your framework's escaping, which is context-aware — what is safe in an attribute differs from what is safe in a script block.
Your text stays in the page
This matters more here than on most tools. People paste API keys into hash generators, customer data into CSV converters, contract wording into diff checkers and configuration into JSON validators. Almost every site offering these sends your input to a server to process it.
Nothing here is transmitted. The work happens in your browser, this site is static files with no server behind it, and the about page lists every request the site makes, read live from your own browser so you can check rather than trust.