Skip to content

HTML Entity Encode

Escape characters that break HTML — &, <, >, quotes — with named or numeric entities.

Input

Output

Escaping characters that break HTML

Five characters change the meaning of HTML: &, <, >, " and '. Writing them as entities tells the browser to display the character rather than treat it as markup — which is also the baseline defence against cross-site scripting when user input ends up in a page.

Numeric references (&#38; or &#x26;) mean the same thing as named ones and work in every parser, which makes them the safer choice when the output will be consumed by something other than a browser.

Frequently asked questions

Does escaping make my page safe from XSS?

It is necessary but not sufficient. Escaping for HTML text is different from escaping inside an attribute, a URL, or a <script> block. Use the escaping that matches the context the value lands in.

Why is &nbsp; not a normal space?

It is U+00A0, a non-breaking space. It looks identical but prevents a line break and is not collapsed with adjacent whitespace.

Related tools

HTML Entity DecodeTurn &amp;, &#39; and other HTML entities back into the characters they represent.URL EncodePercent-encode a URL or query string, with component and full-URI modes plus optional form (+) encoding.Base64 EncodeEncode text or files to Base64, with standard or URL-safe alphabets and optional line wrapping.Base64 DecodeDecode Base64 back to text, choosing the character set (UTF-8, EUC-KR, Shift_JIS, GBK…) so the result reads correctly.File to Base64 / Base64 to FileTurn any file into a Base64 string or a data URI, and turn Base64 back into a downloadable file.Base32 EncodeEncode text to RFC 4648 Base32, with optional Base32hex alphabet and padding control.