HTML Entity Encoder

Five characters carry meaning

In HTML, the ampersand, less-than, greater-than, double quote and single quote have structural meaning. Text containing them must be encoded or the browser interprets them as markup rather than content. Encoding the ampersand first is essential, because encoding it after the others would double-encode the entities you just created.

Context decides the escaping

HTML entity encoding is correct for text inside an element and inside a quoted attribute value. It is the wrong escaping everywhere else. Inside a script block you need JavaScript string escaping; in a URL you need percent-encoding; in a CSS value you need CSS escaping. Applying HTML encoding to a value that lands in a JavaScript context does not make it safe, and this mistaken sense of safety is a common source of cross-site scripting.

Unquoted attributes are dangerous

HTML permits attribute values without quotes, and in that context a space or a slash terminates the value, so entity-encoding the five usual characters is not sufficient to contain an injected payload. Always quote attribute values. It costs two characters and removes an entire vulnerability class.

Named, decimal and hex

The same character can be written three ways: a named entity, a decimal numeric reference, or a hexadecimal one. Named entities are readable but only around 250 exist; numeric references cover every Unicode code point. For anything beyond the common set, numeric is the reliable choice.

Encoding is not sanitising

Encoding renders text inert so it displays literally. Sanitising removes dangerous constructs while keeping some markup functional. If you want users to submit formatted content, you need a sanitiser with an allowlist, not an encoder. Encoding user HTML makes the tags visible as text, which is safe and usually not what was wanted.

Encode on output, not input

Store the raw value and encode when rendering, because the correct encoding depends on the destination. Encoding at input locks the data to one context, corrupts it for every other use, and produces the double-encoded text that shows up as visible entity codes on a page.

Related tools

• JSON Formatter — Format and beautify JSON in your browser. Pinpoints syntax errors by line and column, flags unsafe integers, and never uploads your data to a server.
• JSON Validator — Validate JSON syntax with precise line and column errors, and check documents against a JSON Schema. Runs locally in your browser, nothing uploaded.
• Regex Tester — Test regular expressions against sample text with live match highlighting, capture groups and flag control. Runs entirely in your browser.
• HTML Minifier — Minify HTML by removing comments and redundant whitespace, without breaking inline elements or pre blocks. Runs entirely in your browser.