HTML Entity Encoder

Escape and unescape HTML entities in your browser.

Free, no limit Nothing uploaded Works offline No sign-up

Escaping is what stops user text becoming markup

The moment text written by someone else is placed into a page without escaping, that text can become markup. A comment containing a script tag becomes a running script; a product name containing an angle bracket breaks the layout. Escaping is the fix, and it is five characters long.

Ampersand, less than, greater than, double quote and single quote are all that need converting. Ampersand has to go first, because escaping it after the others would double escape the entities you just created and you would see the entity codes on screen.

Decoding goes the other way, turning entities back into characters, which is what you need when a feed or a database has been escaped twice and your page is showing & where it should show an ampersand.

HTML markup being escaped into entities and back again

How to use it

Paste into the left box and the result appears in the right one as you type. Change any option and it recalculates immediately.

Copy puts the result on your clipboard and confirms it did. Download saves it as a file, which is the easier route when the output is long enough that selecting it by hand is a nuisance. Clear empties the boxes and puts the cursor back where you need it.

Where a sample button appears, it loads a small realistic example. It is there so you can see what the tool expects before pasting your own material, which is quicker than reading a description of the input format.

Keyboard and mobile

The text areas are ordinary form fields, so every shortcut your system already has works: select all, undo, redo, and paste without formatting. Tab moves between the panes and the controls in the order you would expect, and every control is reachable without a mouse.

On a phone the panes stack rather than sitting side by side, and the text areas grow to a comfortable height. Spellcheck and autocorrect are switched off in them, because a tool that silently capitalises your html entity encoder input is worse than useless.

If something looks wrong

When the result is not what you expected, the message under the boxes is the first thing to read. It reports what happened rather than a generic failure, so a malformed input names the line to look at and a successful run reports what it did, such as how many lines it kept or how many replacements it made.

A count of zero is informative in itself. It usually means the input did not contain what you thought it did, most often because of capitalisation or an invisible trailing space, both of which are far more common in pasted data than people expect.

Nothing is corrected silently. If the input cannot be handled, the output is left empty and the reason is stated, rather than a partial result being returned that looks plausible and is wrong. A tool that guesses is worse than one that says it could not.

The five that matter, and when

Which characters need escaping depends on where the text is going.

  • In element content, escape ampersand, less than and greater than. That is enough to stop text becoming a tag.
  • In an attribute value, escape the quote character as well, otherwise a value containing a quote closes the attribute early and everything after it is read as more attributes.
  • Single quotes matter when attributes are written with single quotes, which is legal and common in templates.
  • Nowhere else does escaping help. Text going into a URL needs percent encoding and text going into a database needs a parameterised query. Using HTML escaping for either is a well known way to get it wrong.

This tool escapes all five, which is safe everywhere in an HTML document.

Which encoding for which job

The three encodings on this site solve different problems and are not interchangeable. Using the wrong one produces output that looks encoded and fails in a way that can take an afternoon to find.

EncodingUse it forEscapesGrows by
Base64Binary data in a text channelEverythingAbout 33 percent
Percent, URLValues inside a URLReserved charactersVaries
HTML entitiesText placed into markupFive charactersSlightly

Base64 is for bytes that are not text at all: an image in a data URI, a certificate in a PEM file, an attachment in an email. It is not for making text safe, and it protects nothing.

Percent encoding is for URLs specifically, and even within a URL the rules differ between a path segment and a query value. It exists because a URL reserves punctuation for structure, so a value containing that punctuation has to be escaped or the address means something else.

HTML entities are for text going into markup, so that a less than sign stays a less than sign instead of opening a tag. This is the encoding that stops user supplied text becoming executable, and it is applied at the moment of output, not when the data is stored.

The rule that avoids nearly every bug: encode at the boundary, once, for the destination the text is entering. Encoding early, or twice, is how you end up with visible entity codes and double escaped URLs in production.

Safe to use with real data

Most online developer tools post whatever you paste to a server. For a toy example that is fine. For the payload you are actually debugging, which is a production API response with customer records in it, an internal configuration file or a token, it is a data disclosure that nobody signed off.

Everything on this page runs in your browser. The parsing, the conversion and the formatting all happen in memory on your own machine. Nothing is transmitted, nothing is logged, and there is no server that could keep a copy even if someone asked it to.

You can check that yourself: open your browser's network panel, paste something in and watch nothing happen. Then disconnect from the internet and use the html entity encoder tool anyway, because once the page has loaded it does not need the network again.

That constraint also shapes what we will build. Anything that genuinely requires a server, such as looking up a value in a database, is not something we can offer honestly under these terms, so we do not offer it at all.

No limits, and no account

There is no cap on how much text you can run through this, no daily quota and no sign up wall at the point where it becomes useful. The HTML Entity Encoder tool costs us nothing to provide because it runs on your device rather than ours, so there is nothing to meter.

There is also nothing to install. It is one page of HTML, one stylesheet and one script, which together come to a fraction of the weight of a single photograph. It loads in well under a second on a phone connection and works immediately.

Why we built it this way

Developer tools that upload your input are a poor bargain. You get a conversion and they get your data, and the thing you pasted was usually the one piece of text you should have been most careful with. Running it locally removes the trade entirely.

The whole site is built on the same rule: if the work can be done in the browser, it is done in the browser. Over a hundred tools work that way, and the handful that genuinely cannot are the ones we have not built.

It also means the tool keeps working when we are not paying attention to it. There is no service to go down, no API key to expire and no rate limit to hit at the moment you need it most. The page you loaded is the whole program, and it will behave the same way in five years as it does today.

FAQ

HTML Entity Encoder

The questions people ask most about this tool.

Ampersand, less than, greater than, double quote and single quote. The ampersand must be escaped first, otherwise you double escape the entities you have just written.

The text has been escaped twice. Decode it once with this tool and check where in your pipeline the second pass is happening.

In HTML content, yes, and it is the primary defence. It does not protect text placed inside a script block, a URL or a style attribute, each of which needs its own escaping.

They need no escaping in a UTF-8 page, which is every modern page. Named entities for them exist but are no longer necessary.

Completely, with no account, no quota and no paid tier. It runs on your own device, so there is nothing for us to meter and nothing to charge for.

No. Everything happens inside this page, in memory on your machine. Nothing is transmitted, stored or logged, and you can confirm it by watching your browser's network panel while you type.

Yes. Once the page has loaded it never needs the network again, so you can disconnect and carry on working.

None that we impose. The practical limit is your device's memory, which on a modern machine is a very large amount of text.

Yes. The panes stack on a narrow screen and the controls stay reachable. Autocorrect is switched off in the input, so nothing is silently changed as you type.

Yes, freely and with no attribution required. What you paste is yours and so is what comes out.

Need a different conversion?

Over a hundred free tools, all running in your browser. Nothing is uploaded and nothing is capped.