HTML-encode Text
Prevent XSS vulnerabilities and syntax errors by encoding HTML reserved characters into named entities (&, <, >, ", ').
Step-by-Step Instructions
Paste Plaintext or HTML
Paste source text containing special characters, symbols, or HTML tags.
Select Encoding Standard
Choose Named HTML Entities (`&`, `<`, `>`), Decimal Numeric (`&`), or Hexadecimal Entities (`&`).
Configure Scope
Choose to encode only reserved HTML characters (`<`, `>`, `&`, `"`, `'`) or all non-ASCII characters.
Copy Encoded String
Copy the sanitized entity string ready for safe embedding in HTML documents.
Key Features & Capabilities
- Converts special characters to standard W3C HTML5 named entities (`&`, `<`, `>`, `"`, `'`)
- Decimal (`&#NNN;`) and Hexadecimal (`&#xHH;`) numeric character reference (NCR) generation
- Essential protection against Cross-Site Scripting (XSS) when rendering user-submitted text in HTML
- Full Unicode multi-byte character entity encoding
Frequently Asked Questions
Why is HTML entity encoding essential for web security (XSS prevention)?
When displaying untrusted user input inside an HTML document, characters like `<` and `>` can allow an attacker to inject malicious `<script>` tags (Cross-Site Scripting / XSS). Encoding `<` as `<` and `>` as `>` forces the browser to render the characters as visible text without interpreting them as executable markup.
What are the five essential XML/HTML character entities?
The five core reserved entities are: 1) `&` to `&` (Ampersand); 2) `<` to `<` (Less than); 3) `>` to `>` (Greater than); 4) `"` to `"` (Double quote); 5) `'` to `'` (or `'` Single quote).
What is the difference between Named Entities and Numeric Character References (NCR)?
**Named Entities** use human-readable abbreviations (e.g., `©` for ©). **Numeric Character References (NCR)** use the character's Unicode code point in decimal (e.g., `©`) or hexadecimal (e.g., `©`). NCRs are universally supported across all XML/HTML parsers even if a named entity is not defined in older HTML versions.
Should HTML attributes be encoded differently than body text?
Yes. Inside HTML attribute values (e.g., `<input value="...">`), double quotes must be encoded as `"` and single quotes as `'` to prevent an attacker from breaking out of the attribute string delimiter.
Related Utilities
Discover complementary online tools in the same workflow.
JSON Formatter & Validator
Format, beautify, minify, validate, and view JSON data online with instant syntax highlighting and error detection.
Base64 Encoder & Decoder
Encode text or binary data into Base64 format or decode Base64 back into raw string format.
CSV to JSON Converter
Easily convert CSV data to clean JSON format. Turn tabular spreadsheets into structured JSON.
YAML to JSON Converter
Convert YAML configuration files into structured JSON for APIs and modern web tooling.
JWT Parser & Token Debugger
Decode JWT tokens to view header, payload claims, and expiration status without sending secrets anywhere.
Hash Generator (SHA-256, SHA-512, MD5)
Generate cryptographically secure SHA-256, SHA-512, SHA-384, and SHA-1 hashes for any text.