HTML Encoder
Escape &, <, > and quotes into HTML entities so text can be shown safely inside markup. Runs entirely in your browser.
Paste markup to escape
Result
What is HTML encoding?
HTML encoding replaces characters that have a special meaning in markup with named or numeric entities. An ampersand becomes &, a less-than sign becomes <, and so on.
It is used to display code samples, user comments and any text that would otherwise be interpreted as tags by the browser.
How to escape HTML
- Paste the HTML or plain text you want to escape.
- Press Encode HTML.
- The five characters &, <, >, " and ' are converted to entities.
- Copy the escaped result into your template.
HTML encoding examples
A link
<a href="#">Home</a>
<a href="#">Home</a>
An ampersand
Tom & Jerry
Tom & Jerry
A script tag
<script>
<script>
Browser encoder vs other ways
| Dimension | UrsaKit HTML Encoder | Hand-editing entities | Template helpers |
|---|---|---|---|
| Characters covered | The five dangerous ones | Easy to miss one | Depends on the framework |
| Round trip | Pairs with the decoder | Manual | Often |
| Data leaves the device | No, runs in the browser | No | Depends on the app |
Frequently asked questions
Is the HTML encoder free?
Yes, with no account and no limit.
Which characters are escaped?
&, <, > and both quote characters. Those are the characters that change how a browser parses markup.
Is it the same as URL encoding?
No. HTML encoding produces entities like &, while URL encoding produces percent sequences like %26.
Does it prevent XSS?
Escaping output is one part of XSS defence, but you should also validate input and use your framework's own escaping.
Is my data uploaded?
No. Encoding runs in JavaScript in your browser.