HTML Encoder
Turn the five HTML text specials into character references so the string can sit in HTML text. Named entities for ampersand, less-than, greater-than, and quotes; numeric ' for apostrophe. Other characters, including emoji, are left as they are.
Rated 4.7 out of 5 based on 310 reviews
How to HTML-encode
- Paste the text in Input.
- Optional: encode every non-ASCII character as a numeric reference. Specials always encode.
- Copy or download the escaped string.
- Use the HTML decoder for the reverse. Do not treat this as a sanitizer.
HTML character references
Escapes for HTML text, matching js-htmlencode 0.3.0 encode rules
| Ampersand | & |
|---|---|
| Less-than | < |
| Greater-than | > |
| Double quote | " |
| Apostrophe | ' |
| Order | Ampersand first so replacements are not re-escaped |
What this encoder changes
It replaces five characters that have meaning in HTML text and quoted attributes: ampersand, less-than, greater-than, double quote, and apostrophe. The replacements match the js-htmlencode 0.3.0 rules used on emn178 Online Tools: named & < > " and numeric ' for apostrophe. This is not a full HTML sanitizer and not a way to hide secrets.
Text, attributes, and scripts
Escaping for a text node is not the same as escaping for an HTML attribute, a URL, or a JavaScript string. Putting the output inside a script element or an event handler is the wrong context. URL encoding is a different job: URL encoder.
Not a sanitizer
An encoder does not remove tags, does not enforce a content-security policy, and does not make untrusted HTML safe to assign to innerHTML by itself. Decode on the HTML decoder if you need the reverse. Base64 is under Base64.