Which characters get escaped
Five characters change meaning inside HTML and are replaced with named or numeric entities:
| Character | Entity |
|---|---|
| & | & |
| < | < |
| > | > |
| " | " |
| ' | ' |
The ampersand is always replaced first, otherwise the entities produced afterwards would be escaped a second time.
The URL decoder handles the same job in a slightly different way.
How to use this encoder
Paste the markup you want to show as text - a code sample for a blog post, a tag name inside documentation, or a value going into an attribute - and copy the escaped result. Entering <b>Hi</b> returns the escaped form <b>Hi</b>, shown here as literal characters so you can copy it straight into a template. To wrap values for a query string instead, use the URL encoder.
Copy the escaped output straight into a template, a Markdown code fence or a CMS rich-text block. Everything runs in your browser, so the markup you paste is never uploaded or stored on a server.
When you need something similar but not identical, the Base64 encoder is there.
Why escaping matters
Unescaped user input is the classic route to cross-site scripting: a comment containing a script tag becomes executable code once it is written into a page. Escaping the five special characters turns that input back into inert text. Modern templating engines escape by default, but anything built by string concatenation, injected with innerHTML, or pasted into a CMS block needs escaping by hand. Structured payloads should also be validated with the JSON formatter before use.
Two habits catch most problems: escape at output rather than on input, and escape once only, since double-escaping shows raw entity text on the page.
Frequently asked questions
- What does <b>Hi</b> look like when HTML encoded?
- It becomes <b>Hi</b>, so the browser prints the tags instead of applying bold formatting.
- Why is the ampersand escaped first?
- Because every other replacement introduces an ampersand. Escaping it last would corrupt the entities that were just created.
- Do I need to escape quotes?
- Yes, if the value goes inside an HTML attribute. An unescaped quote can close the attribute early and let extra markup in.
- Does escaping change how the text looks to readers?
- No. The browser converts each entity back to its character when rendering, so readers see the original text.
- Is the text I paste sent to a server?
- No. The escaping runs entirely in your browser with JavaScript, so the markup you paste is never uploaded, transmitted or stored anywhere. You can safely encode snippets that contain internal code or customer data.