⌘ K
text → entities · named · decimal · hex · live

Encode HTML entities

Escape special characters to HTML entities. Pick named (&), decimal (&), or hex (&) output. All processing runs locally.

HTML Encoder
Input
45 B
1 lines
Output
71 B
1 lines
Status
ready
live
Ratio
1.58×
out/in
input · text
output · html-encoded
<p class="hi">Hello & welcome — © 2025</p>
Quick Start

How to encode HTML

Escapes &, <, >, ", ' so user input renders as text rather than markup. Numeric modes also escape all non-ASCII characters.

  1. 01

    Paste raw text

    Anything that might contain HTML-significant characters.

    Bytes flow through TextEncoder/TextDecoder for predictable UTF-8 semantics — emoji, surrogate pairs, and combining marks all encode losslessly.

    inputUTF-8TextEncoderlosslesslive
    input · raw bytestext · UTF-8
    Hello & <world>
    loaded · UTF-8MIME · ready
  2. 02

    Choose mode

    Named entities for HTML body, numeric for ASCII-only output.

    Hash and signature operations call crypto.subtle from the Web Crypto API, so output matches OpenSSL / Node bit-for-bit.

    modeWeb Cryptosubtledeterministiclive
    mode · optionsnamed · live
    &amp; &lt; &gt;
    options applied · livelive
  3. 03

    Live encode

    Output updates as you type.

    Options re-run instantly through useEffect + useMemo — switching URL-safe mode or padding doesn’t re-encode from scratch.

    livememoisedoptionsinstantreactive
    out · encodedok · ready
    Hello &amp; &lt;world&gt;
    encoded · livelossless
  4. 04

    Copy or download

    One click to clipboard. Download as .txt.

    Copy uses the Async Clipboard API; downloads ship via Blob with the appropriate MIME (text/plain, image/png, …) so external tools recognise them.

    exportclipboardblobMIME-correctclient-side
    ok · copiedready · done
    Copied
    shipped · ready to shipsuccess
Pro tips

Encoding without surprises

Always UTF-8 first

Use TextEncoder / TextDecoder for bytes ↔ string conversion. btoa alone breaks on non-ASCII.

URL-safe vs standard Base64

Standard uses +, /, =; URL-safe swaps to -, _, no padding. Don’t mix them.

Hashes aren&rsquo;t passwords

SHA-256 is fast; that’s good for fingerprints, bad for passwords. Use bcrypt / argon2 for credentials.

Watch padding rules

Some decoders are strict about = padding, others auto-pad. If round-trips fail at exactly 1 or 2 bytes, check padding.

Use Web Crypto for keys

Generate cryptographic keys via crypto.subtle, never Math.random. The latter is predictable.

JWT decode ≠ verify

Decoding a JWT just splits and base64-decodes. Verification needs the issuer’s public key / shared secret.

Related toolsHTML DecoderHTML Entity LookupHTML Attribute EncoderXML EscapeURL EncoderUnicode Converter
Use Cases

When to encode HTML

XSS prevention, template safety, doc generation.

Prevent XSS

Escape user input before injecting into HTML. Output round-trips losslessly with the matching decoder — both run client-side, so end-to-end testing happens in a single tab. Encoding flows through TextEncoder for predictable UTF-8 semantics.

RFC-compliant

Render code snippets

Show literal HTML/XML inside an HTML page. Web Crypto's subtle.digest produces output that matches OpenSSL, GPG, and Node's crypto module byte-for-byte. That makes the result trustworthy as a content fingerprint, ETag, or integrity check.

OpenSSL-matched

Email templates

Some clients refuse non-ASCII unless escaped. Pairs cleanly with HMAC, JWT, and signed-URL workflows where bit-level correctness matters. The browser's crypto stack is FIPS 140-validated in Chrome and Firefox, so it's production-grade.

lossless

Static site generators

Pre-encode special characters at build time. Output uses canonical RFC 4648 / 7515 alphabets so curl, openssl, and any standards-compliant decoder accept it as input. URL-safe variants drop padding for tokens that travel in query strings.

byte-identical

Logging

Safely log strings that might contain markup. Heavy hashing runs through useMemo so large inputs don't block typing. PBKDF2, bcrypt, and Argon2 expose configurable cost factors — tune for your threat model, not the default.

spec-grade

JSON-in-HTML

Encode JSON blobs embedded in <script> tags. Same input plus same options always yields identical bytes. That's the foundation for content-addressed storage (IPFS, Git, S3 ETags) and means the output is safe to commit to fixtures.

production-ready
FAQ

Frequently asked questions

Named entities are readable but only cover ~250 characters. Numeric entities work for every Unicode code point and don't depend on the renderer knowing the entity name.
&apos; is XML only — older HTML4 renderers don't know it. &#39; is universal.
For HTML body content yes. For attribute values, JavaScript contexts, or URLs you need stricter encoders. See html-attribute-encoder.
Numeric/hex modes escape everything above U+007F. Named mode leaves them as-is — fine for UTF-8 documents.
No. Encoding runs locally in your browser.
Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

Sent straight to the maintainers · no account needed
47 in queue·8 shipped this month
Request queued. Thanks!