How the HTML Encoder works
Five characters have a special meaning in HTML. The encoder always replaces them: & with
&, < with <, > with >,
" with " and ' with '. The result displays as the
original text when placed in an HTML element or a quoted attribute value, instead of being read as markup.
Use named entities where available writes characters from the HTML 4 entity set by name, for example
, ©, é and —.
Encode all non-ASCII characters writes every other character above U+007F as a hexadecimal reference such as
é, which is useful when a page or email template cannot be saved as UTF-8. Emoji and other
characters outside the Basic Multilingual Plane are written as one reference to the full code point
(😀), not as two surrogate halves.
Encoding makes text safe to display, but it is not a complete defence against cross-site scripting: text placed in JavaScript, CSS or unquoted attributes needs different escaping.
How to use the HTML Encoder
- Paste your text or HTML into the input box, open a file, or select Load example.
- Tick Use named entities where available to write characters such as © and é as © and é.
- Tick Encode all non-ASCII characters to turn every remaining character above U+007F into a numeric entity such as é.
- Select Encode HTML, or press Ctrl + Enter (Cmd + Enter on a Mac), then copy or download the result.
Example
This input:
<p class="note">Tom & Jerry's café – © 2026 😀</p>is encoded with the default options as:
<p class="note">Tom & Jerry's café – © 2026 😀</p>With both options ticked, the characters after Jerry become:
Jerry's café – © 2026 😀</p>Common use cases
- Showing HTML or XML source code as text in a blog post, documentation page or code sample.
- Escaping user-supplied text before inserting it into an HTML template by hand.
- Putting text with quotes into an HTML attribute value.
- Preparing email templates or legacy pages that must stay ASCII-only.
- Checking what a server-side HtmlEncode function should output for a tricky string.
Frequently asked questions
Which characters are always encoded?
& becomes &, < becomes <, > becomes >, " becomes " and ' becomes '. These five are enough for text inside HTML elements and quoted attribute values. ' is used for the apostrophe because ' is not defined in HTML 4.
When should I encode non-ASCII characters?
Only when the page or template cannot be saved and served as UTF-8, such as some older email systems. Modern pages declared as UTF-8 can contain characters like é, € and emoji directly.
How are emoji encoded?
As a single hexadecimal reference to the full code point, for example 😀 becomes 😀. The tool never writes the two UTF-16 surrogate halves as separate entities, which browsers would show as two replacement characters.
Which named entities are used?
The HTML 4 set: Latin-1 characters such as , © and é, typographic characters such as —, – and …, Greek letters, arrows and math symbols. Characters without a name in that set are left as they are unless Encode all non-ASCII characters is ticked.
Does HTML encoding protect against XSS?
It prevents text placed inside HTML elements and quoted attributes from being read as markup, which is the most common case. It is not enough for text inserted into JavaScript, CSS, URLs or unquoted attributes, which each need their own escaping. Use your framework's built-in encoding in production code.
Is my text uploaded?
No. Encoding runs in your browser and nothing is sent to our server.