ToolAtlas
FavoritesRecent

HTML entity encoder

Processed in this browser

Text limit: 2000000 characters

This tool never uploads your input.

A CMS that ate your ampersands, or a paste from Word full of smart quotes. Encoding is not a security control.

A title AT&T that became AT in a feed, or a snippet you need as <div>. This page maps characters to entities. It will not make a blob of user HTML safe.

URLs: URL encoder. Seeing the page: Markdown preview. Escaping for a JSON string is still JSON’s job on the formatter.

Markup, not query strings

Putting < into an HTML body needs entities. Putting a search string into a URL needs percent-encoding — that is the URL encoder. This is not an XSS scanner or a CSP setup. Attribute vs text-node rules still differ; glance at the result.

How to use it

  1. Paste the text or the entity soup.
  2. Encode or decode.
  3. Paste back into the CMS. Preview there, not only here.

Honest limits

Not DOMPurify. Not a full HTML parser that understands every historic entity.

FAQ

Will this stop XSS?

No. Use a real sanitizer and a framework’s text interpolation. Entity-encoding a whole document is not a policy.

Named vs numeric entities?

We follow whatever the control offers. Not every named entity exists in HTML4.

Is this URL encoding?

No. Query strings are the URL encoder. Paths you want readable are slugify.

Markdown preview?

Preview renders Markdown. This page only rewrites entities.

Is the HTML uploaded?

No.

Related tools