About HTML Encode
HTML encoding replaces the three characters that carry structural meaning in markup — the less-than sign, the greater-than sign and the ampersand — with the entities <, > and &. The purpose is to make text render as text rather than be interpreted as tags.
It matters whenever you are displaying user-supplied or third-party content. If a comment, a filename or a database field contains <script>, emitting it raw into a page would execute it as code; that is the mechanism behind cross-site scripting. Encoding the value before it reaches the template closes that hole at the point where the data is inserted.
A frequent practical need is showing code samples. Explaining an HTML snippet requires the snippet to appear literally rather than be parsed, and that only works once its angle brackets have been turned into entities. Encoding the sample is the simplest way to achieve it.
How to use HTML Encode
- 1 Paste the markup or text you need to display literally.
- 2 The escaped version appears instantly — angle brackets, ampersands and double quotes are converted to entities.
- 3 Paste the output into your page or template where the text should be shown rather than interpreted.
Frequently asked questions
Is encoding enough to prevent cross-site scripting?
It is the core defence for text inserted into HTML body content, but not the whole answer. Values placed inside an attribute need attribute-appropriate quoting as well, and values placed inside a script block or a URL need their own treatment. Encode for the context you are inserting into.
Do I need to encode inside an HTML attribute?
Yes, and double quotes are the reason. If the value contains a quotation mark and the attribute is delimited with quotes, an unencoded quote would terminate the attribute early and let the rest of the value escape into markup. The encoder handles this for you.
Why did my ampersand become & when it looked fine before?
Because a literal ampersand in HTML begins an entity reference. Writing it as & is the only way to display an actual ampersand without the following characters being read as part of an entity name.
Should I encode text before storing it in a database?
No. Store the original text and encode at the point of output. Encoding before storage bakes a display-specific transformation into your data, and you will be decoding it forever — plus it breaks any comparison or search against that column.
Free, online, and private
Free to use
HTML Encode is completely free. There is no account to create, no login, and no hidden charge or usage limit.
Runs online in your browser
It is a free online tool that runs entirely in your browser. Nothing to download or install — open the page and start using it right away.
Your data stays private
All processing happens locally on your device. Your input is never uploaded, stored, or tracked, so it never leaves your browser.
How HTML Encode behaves in detail
These are the specifics of this implementation — the exact ranges, defaults and fixed settings you are working with.
| Parameter | Value |
|---|---|
| Characters escaped | five — ampersand, less-than, greater-than, double quote and apostrophe |
| Order of work | the ampersand is replaced first, so nothing is double-escaped by this run |
| Apostrophe form | ', the numeric escape, rather than the named ' |
| Everything else | passed through unchanged, including letters outside ASCII |
| Options | none — a single fixed behaviour with no entity-mode or ASCII-only switch |
Compiled from the implementation of this tool and checked against it by itoolnet.
What HTML Encode does not do
Knowing the edges of a tool saves more time than another list of its features. These are the cases where it will not do what you might expect.
- Only five characters are escaped. Text that already contains entities is escaped a second time, so & becomes &amp; — a string that has passed through this tool must not be fed back into it.
- Nothing here knows about the target charset. Characters above ASCII are written out literally, which is right for a UTF-8 document and wrong for one served as Latin-1, and there is no mode that escapes them numerically instead.
- Apostrophes are written as ' while the named ' form is never produced, so output may differ byte for byte from another encoder even when both render identically in a browser.
Tested and documented by itoolnet, the team that builds and maintains this site.