HTML Entity Encoder
Convert <, >, &, quotes and optionally every non-ASCII character into HTML entities, so markup renders as visible text rather than being parsed.
How it works
Five characters carry meaning in HTML: & < > " and '. Replacing each with its entity means a browser renders them literally instead of treating them as markup — which is how you show a code example on a page.
The non-ASCII option converts accented letters and symbols into numeric entities such as é. Modern pages served as UTF-8 do not need this, but some legacy email templates and older systems still do.
The formula
Core escapes
& → & < → < > → > " → " ' → '
Numeric entity
character → &# + decimal code point + ;
Worked examples
| Scenario | Working | Result |
|---|---|---|
| <a href="/x"> | Escape | <a href="/x"> |
| Tom & Jerry | Escape | Tom & Jerry |
| café | Non-ASCII on | café |
When you'd use it
- Showing a code snippet on a web page
- Putting user-supplied text into HTML safely
- Fixing an ampersand that breaks validation
- Preparing content for a legacy email template
Common questions
Does escaping HTML prevent XSS?
It is a necessary part of it, but escaping at display time in your template engine is the real defence. Pasting text through a tool is fine for a one-off snippet, not a substitute for output encoding in code.
Why is & escaped first?
Because entities themselves start with &. If & were escaped last, an entity like < would become &lt; and display as literal text. Ordering matters, and this tool gets it right.
Do I need the non-ASCII option?
Rarely. If your page declares UTF-8 — which nearly all do — accented characters work as-is. Turn it on only for systems that mangle anything outside ASCII.