HTML Encoder
Escape characters so markup displays as text.
Options
Private by design. This tool runs entirely in your browser. Your input is processed on your own device and is not uploaded by DO101.
About the HTML Encoder
Converts &, <, >, quotes and optionally every non-ASCII character into HTML entities, so code samples and user text display literally instead of being interpreted as markup.
How to use it
- 1Paste your text or markup.
- 2Choose whether to encode non-ASCII characters too.
- 3Copy the encoded output.
What you get
- Escapes &, <, >, " and '
- Optional numeric entities for every non-ASCII character
- Safe for code samples
- One-tap copy
- Runs in your browser
Frequently asked questions
Is this enough to prevent XSS?
No. Entity encoding is one part of output escaping, but safe rendering depends on context — attributes, URLs and script blocks all need different treatment. Use your framework's escaping, not a copy-paste tool.
Why encode non-ASCII characters?
Only for legacy systems that mishandle UTF-8. Modern pages should declare UTF-8 and leave the characters alone.
Keep going
People who use this tool usually reach for these next.
Turn HTML entities back into readable characters.
Percent-encode text so it is safe inside a URL.
Encode or decode Base64 text and files, Unicode-safe.
Make text safe inside a JSON string, or turn it back.