HTML Entity Encoder

Those are the characters that can end a tag or an attribute value early. The sample shows all of them at work:

Nothing else changes. Accented letters, symbols, emoji, tabs and line breaks pass through as they are: Café © 2026 — 5 > 3, it's becomes Café © 2026 — 5 > 3, it's. On a page served as UTF-8 that is all you need.

The encoder doesn't recognise existing entities. Every ampersand is escaped, including the one at the start of an entity:

On a page, that shows the reader the literal text &. If the result looks like that, the text was encoded twice somewhere, perhaps once by your CMS and once here. Encode raw text exactly once, at the point where it goes into the HTML.

The usual job for this tool is showing a snippet as text, for example in a tutorial. Encode it, then place it inside <pre><code>:

Running that through the HTML Entity Decoder gives back the original line character for character, so you can check a snippet before publishing it.

Encoded text is safe between tags and inside a quoted attribute value, because it can no longer open a tag or close the quotes. It doesn't make a value safe everywhere:

• Inside a <script> block the browser doesn't decode entities, so use JavaScript string escaping there.
• In a link's URL, a javascript: address still runs after encoding, because it contains none of the five characters. Check the scheme instead.
• For query string values, use percent-encoding with the URL Encoder.