HTML Encode Converter
Escape HTML so markup shows as text instead of rendering.
Text
Escaped HTML
About the HTML Encode converter
When you want a browser to display markup rather than run it, the special characters have to be replaced with entities. `<` becomes `<`, `&` becomes `&`, and the tag is shown as text.
This is the escaping every templating engine does for you. Doing it by hand is for the cases where you are pasting a code sample into a CMS, or writing documentation about HTML.
Which characters are escaped
The five that matter: `&`, `<`, `>`, `"` and `'`. Ampersand has to go first, otherwise the ampersands in the other entities get escaped again.
Quotes are included because escaped text is often inserted into an attribute, where an unescaped quote would close it early.
Escaping is not a security boundary
HTML escaping prevents injection when text is placed in element content or a quoted attribute. It does not make text safe inside a `<script>` block, a `style` attribute, or a URL — those contexts have their own rules.
For application code, escape at render time with your framework rather than storing pre-escaped text in a database.
Frequently asked questions
Should I escape non-ASCII characters?
Rarely. Any page served as UTF-8 handles accents and emoji directly. The option exists for legacy systems that mangle anything above ASCII.
Why is the apostrophe ' rather than '?
Numeric entities work everywhere. ' is not defined in HTML 4 and older parsers can choke on it.