Encoding
Encode text to HTML entities
HTML Encoder escapes the characters HTML reserves: & becomes &, < becomes <, > becomes >, a double quote becomes " and a single quote becomes '. A browser then shows the result as text instead of reading it as markup, which is what you want when you paste code into a web page, an email template or a CMS field. Because both quote types are escaped, the output is also safe inside a quoted attribute value.
How to use HTML Encode
- Open HTML Encode in the Toolbox101 app.
- Paste or type text that contains markup, such as
<a href="/x">Tom & Jerry</a>, into theInputbox. - Read the escaped text in the
Outputbox:&is now&,<is<,>is>, and quotes are"or'. - Click
Copyand paste the result wherever it should be shown as text rather than read as markup.
Worked example
HTML Encode returns the output below for this input.
Input
<a href="/x">Tom & Jerry</a>Output
<a href="/x">Tom & Jerry</a>Check it yourself: open HTML Encode and enter the same input.
Frequently asked questions
Which characters does HTML encoding escape?
Five: & < > and both kinds of quote. & becomes &, < becomes <, > becomes >, " becomes " and ' becomes '. Everything else, accented letters and emoji included, passes through unchanged, since it can sit in the page as is when the page is UTF-8.
Can HTML encoding prevent XSS attacks?
It is one layer. Encoding user input at the point where you write it into a page stops injected tags from being read as markup, and because quotes are escaped the result is safe both in element text and in a quoted attribute. It does not make input safe inside a script block, in a URL attribute such as href, or in inline event handlers, and it does not replace a Content-Security-Policy.
What is the difference between HTML encoding and URL encoding?
HTML encoding rewrites reserved characters as entities so a browser shows them as text inside a page. URL encoding percent-encodes a much larger set of characters so a value survives inside a URL, which is why a space becomes %20 and & becomes %26. Use the URL Encode tool when the target is a URL and this page when the target is HTML.
How do I check the escaped output is correct?
Paste it into the HTML Decode tool: you should get exactly the text you started with. Or drop the output between tags in any HTML document and confirm the browser displays the literal string instead of rendered markup.