What is HTML Encode?

Browsers treat certain characters as instructions. A literal "<" in your content starts a tag; a raw "&" begins an entity. The HTML Encode tool neutralizes these characters by converting them to entities — "<" becomes "&lt;", "&" becomes "&amp;" — so your text displays exactly as written instead of being interpreted as markup.

This is the essential step whenever code or special characters must appear visibly on a page: a blogger publishing a code snippet, a forum displaying user comments, documentation showing example markup, or any template inserting untrusted text into HTML. Without encoding, a single stray angle bracket can break a layout or worse.

How to use

1. Paste the raw text or code snippet into the input. It can be anything from a one-line expression to a full block of source code.
2. The encoder scans for the five characters that matter in HTML: &, <, >, double quotes, and single quotes.
3. Click encode. Each special character is replaced with its entity (&amp;, &lt;, &gt;, &quot;, &#39;), while all other text passes through unchanged.
4. Copy the encoded output and paste it into your HTML, template, or CMS source view, where it will render as literal text.

Common use cases

• Publishing code samples: Tutorial authors encode snippets so readers see the actual code instead of the browser trying to render it.
• Displaying user content: Comment systems and forums encode submissions so a user's "<b>" shows as text rather than bolding everything after it.
• Writing documentation: API docs constantly show example markup and query strings full of & and <> — encoding keeps those examples intact.
• Email signatures: Encoded characters survive the trip through mail clients and webmail composers that would otherwise reinterpret raw symbols.

Example

Input:  <a href="page.html?a=1&b=2">link</a>
Output: &lt;a href=&quot;page.html?a=1&amp;b=2&quot;&gt;link&lt;/a&gt;

FAQs

Which characters get encoded?

The five HTML-significant characters: & → &amp;, < → &lt;, > → &gt;, " → &quot;, and ' → &#39;. Everything else — letters, digits, spaces, even accented characters — is left alone, since modern pages declare UTF-8 and render those directly.

Does encoding alone prevent XSS attacks?

It is a strong first layer but not a complete defense. Encoding user text before inserting it into HTML neutralizes the classic "<script>" injection. However, URLs, JavaScript contexts, and event handlers need additional context-specific escaping — treat encoding as necessary but not sufficient for security.

What happens to already-encoded input?

It gets encoded again: "&lt;" becomes "&amp;lt;". This is correct behavior for text that should display literally, but if your goal was to keep existing entities working, decode first and then encode the result once.

Should I encode quotes too?

Yes when the text lands inside an HTML attribute. A stray double quote can break out of an attribute value and let an attacker inject new attributes. Encoding quotes closes that hole, which is why this tool handles them alongside the angle brackets.