Skip to content

HTML Encoder

Characters to escape
Encoded HTML —
Characters escaped
—
Input length (characters)
—
Output length (characters)
—

Paste text and the encoder replaces the five markup characters with entities: & becomes &, the angle brackets become < and >, double quotes " and apostrophes '. For example, Tom & Jerry becomes Tom & Jerry. Optionally, accented letters and emoji are written as numeric references such as é for é.

About this tool

Code samples in a blog post, user comments shown on a page and text dropped into an attribute all break when they contain raw markup characters. A stray ampersand or angle bracket either disappears or turns into a tag. This encoder rewrites those characters as HTML entities so the browser shows them literally. It also lists each character it changed, with its Unicode code point and how often it appeared, and counts the length before and after. Two extra modes write every non-ASCII character as a decimal or hexadecimal numeric reference, which helps when a page or email system cannot be trusted to keep UTF-8. One limit: escaping text for HTML is not the same as escaping it for JavaScript strings, URLs or CSS, which follow their own rules.

How to use it

  1. Add the text

    Paste text or HTML into the box, or open a .txt or .html file from your device.

  2. Choose what to escape

    Markup only handles & and the angle brackets and quotes; the other two options also convert every non-ASCII character to a decimal or hex reference.

  3. Copy the output

    The encoded HTML updates as you type; copy it into your page, template or CMS.

  4. Check the table

    The table lists each character that was replaced, its code point and how many times it occurred.

Examples

A bold tag shown as text

Text or HTML to encode
<b>Tom & Jerry</b>
Characters to escape
Markup only

Result Encoded HTML: <b>Tom & Jerry</b>
Characters escaped: 5
Input length (characters): 18
Output length (characters): 34

  1. Replaced & < > " ' with & < > " ' (5 characters escaped in total).
  2. Non-ASCII characters were left as they are; this is safe when the page is served as UTF-8.

Both tags and the ampersand are escaped, so a browser prints the markup instead of making the words bold.

Quotes inside an attribute value

Text or HTML to encode
a="x" b='y'
Characters to escape
Markup only

Result Encoded HTML: a="x" b='y'
Characters escaped: 4
Input length (characters): 11
Output length (characters): 29

  1. Replaced & < > " ' with & < > " ' (4 characters escaped in total).
  2. Non-ASCII characters were left as they are; this is safe when the page is served as UTF-8.

Double quotes become " and single quotes ', so the text can sit inside either kind of attribute quote.

Accents and the euro sign as decimal references

Text or HTML to encode
café €5
Characters to escape
Plus non-ASCII (dec)

Result Encoded HTML: café €5
Characters escaped: 2
Input length (characters): 7
Output length (characters): 18

  1. Replaced & < > " ' with & < > " ' (2 characters escaped in total).
  2. Every character above U+007E was written as a decimal numeric reference.

é is code point 233 and € is 8364, so the output is plain ASCII that survives any legacy encoding.

How it is calculated

& → & · less-than → < · greater-than → > · " → " · ' → ' · other code point n above 126 → &#n; or &#xHEX;

n
the Unicode code point of the character, in decimal
HEX
the same code point in hexadecimal, upper case

The text is read one Unicode code point at a time, so an emoji outside the Basic Multilingual Plane becomes a single reference such as 😀 rather than two broken surrogate halves. The five markup characters are always replaced. In the non-ASCII modes, any code point above U+007E is also replaced by its numeric character reference, which every HTML parser decodes back to the same character.

When not to use it

  • For values placed inside a script block or an inline event handler, use JavaScript string escaping instead.
  • For query strings and links, percent-encoding is the correct format, not HTML entities.
  • Text that is already encoded will be encoded twice, turning & into &amp;.

Common mistakes

  • Encoding a whole HTML template when only the user-supplied text inside it needs escaping.
  • Forgetting the apostrophe, which breaks attributes written with single quotes.
  • Converting non-ASCII characters on a UTF-8 page where they would display correctly as typed, which makes the source harder to read.

Frequently asked questions

Which characters have to be escaped in HTML?

In text content, the ampersand and the less-than sign are the ones that can start markup. Inside attribute values the quote character used around the value also has to be escaped. Escaping all five, including the greater-than sign and the apostrophe, is the safe default used by most templating libraries.

Why is the apostrophe written as ' and not &apos;?

&apos; was not defined in HTML 4, so some older browsers and email clients show it literally. The numeric reference ' works in every version of HTML and XML.

Do I need to encode accented letters and emoji?

Not if the page is served as UTF-8 with a matching meta charset, which is the norm today. Numeric references are useful for systems that strip or mangle non-ASCII bytes, such as some older email gateways or databases in Latin-1.

What is the difference between decimal and hex references?

They name the same code point in different bases. The euro sign is € in decimal and € in hex; browsers treat both the same. Hex matches the U+ numbers in Unicode charts, which makes it easier to look characters up.

Does encoding make user input safe against cross-site scripting?

It protects text placed in normal HTML content and quoted attributes. It does not protect values put inside script blocks, style blocks, URLs or unquoted attributes, which need context-specific escaping.

How do I reverse the encoding?

Any browser decodes the entities when it renders the page. To get the raw characters back as text, run the output through an HTML decoder, which maps each entity to its character.

Cite this tool

Using this tool in an assignment, article or report? Copy a citation, or a link for your website.

APA

Tools Directory Editorial Team. (2026, October 12). HTML Encoder. Tools Directory. Retrieved October 26, 2026, from https://tools.milunir.com/converters/text-encoding/html-encoder/

MLA

Tools Directory Editorial Team. “HTML Encoder.” Tools Directory, 12 Oct. 2026, https://tools.milunir.com/converters/text-encoding/html-encoder/. Accessed 26 Oct. 2026.

Chicago

Tools Directory Editorial Team. “HTML Encoder.” Tools Directory. Last modified October 12, 2026. Accessed October 26, 2026. https://tools.milunir.com/converters/text-encoding/html-encoder/.

Link<a href="https://tools.milunir.com/converters/text-encoding/html-encoder/">HTML Encoder – Tools Directory</a>