What does an HTML encoder do?
An HTML encoder replaces characters that have a special meaning in HTML with entity references, so a browser shows them as text instead of reading them as markup. This tool escapes the five characters that matter, &, <, >, " and '. Its decode mode runs the other way, turning entities such as <, © or € back into the characters they stand for.
The five escapes
| Character | Encoded as | Why it needs escaping |
|---|---|---|
& |
& |
Starts every entity, so a bare one can be misread |
< |
< |
Starts a tag |
> |
> |
Ends a tag |
" |
" |
Ends a double-quoted attribute value |
' |
' |
Ends a single-quoted attribute value |
The ampersand is replaced first. If it weren't, the & inside a freshly made < would itself get escaped.
Worked example. Encoding this snippet:
<a href="/x?a=1&b=2">Tom's</a>
gives:
<a href="/x?a=1&b=2">Tom's</a>
Paste that into a page and readers see the original tag as text, which is what you want for code samples, tutorials and showing user input back to the user. The & inside the URL is escaped too; inside an href attribute, & is the correct way to write a literal ampersand anyway.
Encoding text for a page
- Choose Encode in the Direction menu.
- Paste the text or code you want to show literally.
- Click Convert and copy the result into your HTML.
Characters outside those five are not turned into entities. © café € comes out unchanged. That's deliberate and safe for any page served as UTF-8 with a <meta charset="utf-8"> declaration, which is the default for HTML today. Converting every accented letter to é makes the source harder to read without changing what the browser displays.
How decoding works
Decode mode hands your text to the browser's HTML parser in a context where tags aren't built, so only character references are converted. That has some useful consequences:
- Every entity in the standard works. The full list of named references is in the WHATWG HTML named character references table.
© 2026 — €5decodes to© 2026 — €5. - Numeric references work in both bases.
©,©and©all decode to©, and👍gives👍. - Tags stay as text.
<b>bold</b> & <script>x</script>decodes to<b>bold</b> & <script>x</script>. Nothing is rendered or executed, and the tags aren't stripped either. - Only one layer is removed.
&lt;decodes to<, not to a bare less-than sign. Text that was escaped twice needs decoding twice.
One behaviour catches people out. For compatibility with old pages, browsers recognise some entity names even without the closing semicolon. © decodes to ©, and & to &. The side effect is that an unknown name beginning with a known one is partly decoded: ¬it; becomes ¬it;, because ¬ is the "not sign" entity. If decoded output contains a stray ¬, © or similar, look for a malformed entity in the source.
decodes to a real no-break space (U+00A0), not an ordinary space, so it can still break exact-match comparisons after decoding.
Where encoding fits in security
Escaping these five characters is the standard defence for untrusted data placed in HTML element content and in quoted attribute values. It isn't enough in other contexts. Inside a <script> block, an event handler, a URL or CSS, an attacker doesn't need < or " to cause trouble. The OWASP XSS Prevention Cheat Sheet lays out the right encoding for each context.
In application code, use your framework's built-in escaping rather than pasting output from a tool. Most do the same job as this encoder:
| Language | Function | Single quote becomes |
|---|---|---|
| PHP 8.1+ | htmlspecialchars() |
' |
| Python | html.escape() |
' |
| This tool | Encode | ' |
All three spellings of the single quote are equivalent to a browser.
Related tools
The HTML viewer renders markup so you can see the difference between encoded and raw HTML. If you're putting text into a URL rather than a page, use the URL encoder, and for strings inside JSON, the JSON escape tool. The HTML cheat sheet covers the surrounding syntax.
Last updated