Boneyard Tools

HTML Entity Encoder

Paste text or markup to escape it into HTML entities. The five reserved characters are always encoded, and you can optionally convert accented letters and emoji to numeric entities. Everything runs in your browser.

How to encode HTML entities

  1. Paste the text or HTML you want to escape.
  2. Turn on non-ASCII encoding if you also need accents and emoji as numeric entities.
  3. Copy the encoded output and drop it straight into your HTML.

Examples

Escape a markup snippet

<div class="x">a&b</div>
&lt;div class=&quot;x&quot;&gt;a&amp;b&lt;/div&gt;

Frequently asked questions

What are HTML entities?

HTML entities are stand-in codes for characters that would otherwise have special meaning in HTML. They start with an ampersand and end with a semicolon, like &amp; for an ampersand or &lt; for a less-than sign.

Why do I need to escape these characters?

Characters like <, > and & control how a browser parses HTML. If you want them shown as literal text instead of treated as tags or entity starts, you have to encode them so the page renders what you actually typed.

What is the difference between named and numeric entities?

Named entities use a readable label, such as &amp; or &quot;. Numeric entities use the character's Unicode code point, such as &#233; for an accented e. This tool uses named entities for the core characters and numeric entities for everything above ASCII.

Does encoding HTML entities prevent XSS?

Escaping the reserved characters is a key defense against cross-site scripting when you insert untrusted text into HTML, because it stops that text from becoming live tags or attributes. It is one important layer, not a complete fix, so still use context-aware escaping and a content security policy.

Why is the ampersand encoded first?

Each entity itself contains an ampersand, so the tool replaces every literal & before adding the others. That prevents double-encoding, where &lt; would wrongly become &amp;lt;.

Is my text uploaded anywhere?

No. The encoding runs entirely in your browser, so your text never leaves your device.

Related tools