Convert characters into HTML entities so markup displays as text instead of being parsed. Escaping the ampersand, angle brackets and quotes is the baseline defence when inserting untrusted text into a page.
Show calculation steps
Processed privately in your browser — nothing you paste is uploaded, logged or stored.
How to use the HTML Entity Encoder
- Paste the text or markup you want to display literally on a page.
- Choose the scope: "Reserved only" escapes the five characters that matter for safety; "Named" also converts accented letters and symbols; "All non-ASCII" makes the output pure ASCII.
- Pick decimal or hexadecimal numeric references if your workflow prefers one.
- Click "Encode entities" and paste the result into your HTML.
Frequently asked questions
Which characters really must be escaped?
In page text, the ampersand and the two angle brackets. Inside an attribute value you must also escape whichever quote character delimits the attribute. This tool escapes all five – ampersand, angle brackets, double quote and apostrophe – because that set is safe in both contexts.
Does escaping entities prevent cross-site scripting?
Escaping is a necessary part of the defence, but context matters. Text placed in an HTML body is safe once these characters are escaped. Text placed inside a script block, a style block, an event handler attribute or a URL attribute needs different escaping rules, and no single transformation covers every case.
Should I use named entities or numeric ones?
Named entities such as é are easier to read, but only a fixed list exists and the names are case-sensitive. Numeric references work for every Unicode character. If your page is correctly served as UTF-8, most non-ASCII characters need no escaping at all.
Why would I convert all non-ASCII characters?
For legacy systems, email templates or generators that cannot be relied upon to preserve the character encoding. Turning everything into ASCII references removes any dependence on the transport declaring UTF-8 correctly.
