HTML entities are codes like &lt; that let you show characters the browser would otherwise treat as markup. Encoding (escaping) turns <, > and & into their entity forms so they display literally and can’t break your page or be used for injection. To escape text, paste it into an HTML entity encoder. Here is when and why.
Encode escapes special characters; decode turns entities back to text.
Add the content or HTML snippet to convert.
Escape accented and non-Latin characters as numeric entities for safety.
Drop the escaped output into your HTML.
Why escape HTML?
If you put user text straight into a page and it contains <script>, the browser may run it — that’s an XSS risk. Escaping converts the angle brackets to entities so the text is shown, not executed. It is also how you display code samples on a page. The HTML entity tool does both directions.
Which characters matter most?
The critical ones are &, <, >, " and ’. Encode & first (it begins every entity). For documents that may be served in unknown encodings, escaping all non-ASCII characters as numeric entities maximises compatibility.
Tip: Escaping is for display, not a substitute for proper output encoding in your framework — but it’s perfect for showing code snippets and sanitising small bits of text.
Encode HTML entities now
Escape or unescape HTML special characters — free, in your browser.
Open the HTML Entity Encoder →Frequently Asked Questions
What are HTML entities?
Codes such as &lt; and &amp; that represent characters which would otherwise be interpreted as markup.
Which characters should I escape?
At minimum &, <, >, " and ’. Optionally escape all non-ASCII characters as numeric entities.
Is my text uploaded?
No — encoding and decoding happen in your browser.