How to use
- Paste text, open a file, or try the sample.
- Choose the format. The result updates as you type.
- Copy the result or download the converted data.
Understanding HTML Entity encoding
Convert HTML-sensitive characters into character references so markup can be displayed as text. The default covers &, <, >, double quotes and apostrophes.
Optionally encode non-ASCII characters too. Choose named references where available, decimal numbers, or hexadecimal numbers.
Escape text for display
Special characters are replaced with character references. Existing ampersands are encoded too: & becomes &amp;. This is one pass over raw text, not a markup formatter.
<p title="Welcome">Tom & Ada</p><p title="Welcome">Tom & Ada</p>The default settings convert this input in one pass.
Named and numeric references
Named mode uses HTML names when available and numeric references where needed. Decimal and hexadecimal modes use Unicode code point numbers. Non-ASCII mode also escapes accented letters, CJK characters and emoji.
Escaping has a context
These results are for text and quoted HTML attribute contexts. They are not a JavaScript, CSS or URL sanitizer. Check the surrounding context and use the appropriate escaping operation in your application.
Up to 5 MiB of input, 20 MiB of output, and 10 seconds per run. Text files must use UTF-8. Base64 encoding also accepts binary files. Documents stay on your device.
Frequently asked questions
Which characters are escaped by default?
Ampersands, angle brackets and both quote characters. Other Unicode text stays readable.
Can I get only ASCII output?
Select Special + non-ASCII to encode the other Unicode characters too.
Why is an existing entity encoded again?
The encoder treats input as raw text. Its ampersand must be represented literally.
Are numeric references based on UTF-8 bytes?
No. They use Unicode code points, so an emoji uses one numeric reference.
Is this an HTML sanitizer?
No. Context-sensitive application security requires more than entity encoding.