HTML entity encoder

Escape markup so it renders as text, or decode entities back, with an option to escape every non-ASCII character for older pipelines.

Direction
html
Entitieshtml
The result appears here

Questions

Which characters have to be escaped?+

Ampersand, less than and greater than always, plus the quote marks inside an attribute. Those five are what separate text from markup; everything else is optional.

When should I escape everything?+

When the output travels through something that is not UTF-8 clean, such as an old email template or a legacy CMS field. On a modern page it only makes the source harder to read.

Does this protect me from XSS?+

Escaping is the right idea, but do it where the value is rendered, with your framework's own escaping, rather than by hand up front. React escapes text nodes for you; the hole is always the place that opts out.

Related tools

URL encoder and decoderPercent-encode a value or decode one back, choosing between a single query value and a whole URL, with the parts listed out when the input is a URL.Base64 encoder and decoderEncode text to base64 or decode it back, with UTF-8 handled correctly and a URL-safe variant for tokens and query strings.Hash generatorHash any text with MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at once, in hex or base64, computed in your browser.

The tools are free. So is most of the library.

2236 blocks and 1325 pieces for shadcn/ui and Tailwind, built on the same tokens these tools write. Install one with a command and the code is yours.

Browse the blocks

No signup for the tools. MIT for free blocks, commercial licence for Pro.

Markdown version