HTML Encode

How to use the HTML Encode

Type or paste into the Text box, or click Sample. You can also drop a text file on either box, or load one into the HTML entities box with its Open file button.

The HTML entities box updates live as you type. It works both ways — edit the HTML entities side to convert back, or click ⇄ Swap to exchange the sides.

Adjust Use named entities (©) and Encode every character in the options bar above the editors; the result refreshes immediately.

Use Copy or Download on either box to take the result, or Clear to start again.

HTML encode text into entities

To HTML encode text means replacing characters with character references that any HTML parser understands, whatever the page’s character set. Unlike a minimal HTML escape, which only changes the five markup characters, this encoder also converts non-ASCII characters — accented letters, currency symbols, typographic quotes, emoji — into entities. Only the invisible control characters U+0080 to U+009F are passed through unchanged.

Options

Use named entities. When a character has an HTML5 name, it is used: é, ©, —, €. Characters without a name, such as most emoji, fall back to hexadecimal references. Turn it off to get hexadecimal references for everything (é).
Encode every character. Converts plain ASCII letters and digits too, producing text made entirely of references.

Example

Input:

<p class="price">Café crème © 2024 — €3.50 & "free" refills</p>

Output:

&lt;p class=&quot;price&quot;&gt;Caf&eacute; cr&egrave;me &copy; 2024 &mdash; &euro;3.50 &amp; &quot;free&quot; refills&lt;/p&gt;

With named entities switched off, the same input becomes:

&#x3C;p class=&#x22;price&#x22;&#x3E;Caf&#xE9; cr&#xE8;me &#xA9; 2024 &#x2014; &#x20AC;3.50 &#x26; &#x22;free&#x22; refills&#x3C;/p&#x3E;

When encoding non-ASCII characters helps

Email templates. Some mail clients and relays mishandle character sets; entities display correctly everywhere.
Legacy pages served as ISO-8859-1 or Windows-1252, where characters like € or “ ” cannot be represented directly.
Systems that strip non-ASCII input, such as older CMS fields, ad-hoc templating or configuration stored in ASCII-only files.

For a modern UTF-8 page, encoding every accented letter is unnecessary and makes the source harder to read; the minimal escape is enough there.

HTML encoding in code

PHP’s htmlentities() converts every character that has a named entity, much like this tool, while htmlspecialchars() only handles the markup characters. Python’s html.escape() and most template engines also escape just the special characters. This encoder is built on the open-source he library, which follows the HTML5 entity list exactly and correctly handles emoji and other characters outside the Basic Multilingual Plane.

A note on “Encode every character”

Encoding plain letters is sometimes used to make email addresses harder for simple scrapers to read. It offers little real protection, since any browser or HTML parser decodes the references instantly. It does, however, make the output several times larger.

Decode entities with HTML Decode. All processing happens in your browser.

Frequently asked questions

What is the difference between HTML encode and HTML escape?

Escaping changes only the characters that are special in HTML: < > & " and '. Encoding additionally converts non-ASCII characters such as é, € or emoji into entities.

Named or numeric entities — which should I use?

Both are valid HTML5. Named entities are easier to read, while numeric references work for every Unicode character and in XML, which only knows five names.

Why do emoji become &#x…; even with named entities on?

Most emoji have no named entity in HTML5, so the encoder uses a hexadecimal reference, which every browser understands.

Does HTML encoding protect against XSS?

Encoding the special characters prevents injection into element content and quoted attributes, the same as escaping. It does not make data safe inside scripts, styles or URLs.