Escape text to HTML entities
Escape text for safe HTML output in your browser — & < > " ' become entities, with an option to armour every non-ASCII character as numeric references. Nothing uploaded.
Paste text, get HTML-safe output instantly: & becomes &, < becomes <, > becomes >, and quotes become " and ' — the characters that break markup or open injection holes when echoed unescaped. Accented letters, symbols and currency marks become their named entities (é, ©, €), so meaningful characters survive round-trips through systems that would otherwise eat them.
The armour option goes further: every character above basic ASCII becomes a numeric reference (é, 中) — the belt-and-braces form for CMS fields, email templates or legacy pipelines that mangle UTF-8 somewhere between your editor and the page. Markup-critical characters stay named either way.
Decoding runs the other way on the same page — paste escaped markup and read the text, with unknown entities passing through untouched so typos like &npsp; stay visible. Everything runs locally in your browser.
Frequently asked questions
- Which characters must be escaped in HTML?
- In text content, only & and < are strictly required (> by convention); inside attributes, whichever quote character delimits the attribute too. This tool escapes all five by default — the safe superset.
- Named or numeric entities?
- Named ones (&) are readable and memorable; numeric ones (&) cover every code point without a lookup table. The default output uses named entities where they exist, and the armour option switches non-ASCII characters to numeric.
- Is escaping the same as encoding to UTF-8?
- No. UTF-8 is a byte encoding for the file itself; entity escaping is markup-level safety inside the document. A UTF-8 file still needs & escaped, and an entity-escaped string can live inside any file encoding.