How to escape text for HTML
- Paste your text into the left Plain text box, a code snippet, user-submitted comment, or anything containing
<,>,&or quotes. The escaped version appears live on the right. - Tick Also encode non-ASCII when the markup has to survive a system without dependable UTF-8, such as a legacy email template, it turns
éintoéand so on. - Press Copy output and drop the result straight into your HTML source, or load Sample to see a real anchor tag get escaped.
- Use ⇄ Swap to send the output through the decoder and confirm it round-trips back to your original text.
What escaping does, with a before and after
Escaping converts the characters that HTML treats as markup into character references that render as the literal symbol instead. Feed in <script>alert('hi')</script> and you get back <script>alert('hi')</script>, text a browser will display as-is rather than execute. The five characters handled by default are & (which must be escaped first, to &, or it would break the other references), < (<), > (>), the double quote ("), and the single quote ('). The two angle brackets stop tags from being parsed; the quotes stop a value from escaping its attribute. Typical jobs: printing code examples in a blog post, pasting snippets into a CMS that doesn't auto-escape, preparing text for an XML or RSS feed, and double-checking what a template engine should be emitting.
Escaping vs. XSS, where it fits
Encoding <, > and & before you drop untrusted text into a page is the front-line defence against reflected cross-site scripting: a would-be <script> tag becomes inert text and never runs. But escaping is context-sensitive, and this is where people get burned. HTML-body escaping is not enough on its own inside a URL attribute like href, inside an inline onclick handler, or inside a <style> block, each of those contexts has its own rules, and a value that is safe in one can be dangerous in another. Use this tool for the common body-and-attribute case and for one-off manual escaping, but in production code lean on your framework's context-aware auto-escaping rather than escaping by hand.
Frequently asked questions
Which characters must be escaped in HTML?
At minimum & (to &), < (to <) and > (to >) in body content, plus the double quote (") and single quote (') inside attribute values, exactly the five this tool escapes by default.
Why must the ampersand be escaped first?
Because every other entity starts with &. If you escaped < to < before handling a literal &, a second pass would mangle it into &lt;. Escaping & first keeps the output correct and reversible.
When do I need to encode all non-ASCII characters?
When the HTML might travel through a system without reliable UTF-8, legacy email clients, old CMS templates, or files with questionable encoding headers. Ticking the option converts é, em-dashes and emoji to numeric entities like é that survive any character encoding.
Does escaping prevent XSS attacks?
Escaping untrusted text before it enters HTML body content is the core defence against reflected XSS, but it is context-dependent. Attribute, URL and JavaScript contexts each need their own escaping, so in production code rely on your template engine's context-aware auto-escaping rather than escaping by hand.
What's the difference between named and numeric entities?
Named entities like < and & are human-readable aliases; numeric entities like é (decimal) reference a character by its Unicode code point. This tool uses named entities for the core five and numeric entities for the optional non-ASCII pass, since numeric references work even where a named entity isn't defined.
How do I turn entities back into characters?
Use the HTML Entity Decode tool, or press ⇄ Swap here. Everything runs in your browser, nothing you paste is transmitted or stored.