Developer Encoding

HTML encoder

Input

<a href="x">Tom & Jerry</a>

What to do

Indent

Output

&lt;a href=&quot;x&quot;&gt;Tom &amp; Jerry&lt;/a&gt;

Processed in your browser · nothing is uploaded

Local · escaping is not sanitising

Escapes the five characters that must be escaped in HTML — `&`, `<`, `>`, `"` and `'` — and decodes named, decimal and hexadecimal entities back again.

How to use the html encoder

1 Paste your input. The result appears immediately.

2 Pick the operation you want.

3 Copy the result, or save it as a file.

Order matters and is the classic bug: the ampersand has to be escaped first, or escaping `<` to `<` and then escaping ampersands produces `&lt;` and the page shows the literal text. Escaping non-ASCII as numeric entities is a separate option and mostly historical — it was necessary when pages were served as Latin-1, and with UTF-8 it only makes the file larger. One thing worth stating plainly: escaping is not sanitising. Escaping makes text display safely; it does not make user-supplied HTML safe to insert, which needs an allowlist-based sanitiser.

Questions

Which characters must be escaped in HTML? −

Ampersand, less-than and greater-than always; double and single quotes inside attribute values.

Why does my output show &lt;? +

Should I escape accented characters? +

Does escaping prevent XSS? +

Is my text uploaded? +

Sources

WHATWG — named character references

Was this tool any good?

INTERNAL SIGNAL ONLY · WE USE IT TO FIND TOOLS WORTH REBUILDING