About the HTML Encoder
In HTML, the characters <, >, &, " and ' have special meanings. If you want to show code on a web page, or safely display text that users typed, these characters must be written as entities such as < and &. Otherwise the browser treats them as markup.
This encoder escapes those five characters. Tick the extra option to convert every non-ASCII character into a numeric entity too, which helps with older systems that do not handle UTF-8 well. Escaping output is a key part of preventing cross-site scripting (XSS), but in real applications you should rely on your framework’s built-in escaping.
How to use it
- Paste your HTML or text.
- Choose whether to encode non-ASCII characters.
- Click Encode HTML and copy the result.
Example
<a href="/menu">Café & Bar</a>
<a href="/menu">Café & Bar</a>
When to use it
- Displaying HTML or XML code examples in blog posts.
- Preparing text for HTML attributes.
- Escaping content for email templates.
- Learning how HTML entities work.
Frequently asked questions
Which characters are encoded?
Ampersand, less-than, greater-than, double quote and single quote. With the option ticked, all non-ASCII characters are encoded too.
How do I reverse it?
Use the HTML Decoder.
Is this enough to prevent XSS?
Escaping is one important layer, but the right escaping depends on where the text is used. Use your framework’s templating and a content security policy in production.
Is the text I enter kept private?
Yes. The HTML Encoder runs entirely in your web browser, so your text is never uploaded to or stored on our servers. Like most free websites, TextForge shows ads from Google, which may use cookies. See our Privacy Policy for details.