Which characters are escaped?

The five HTML-significant characters: ampersand, less-than, greater-than, double quote, and single quote.

Is this enough to prevent XSS?

Escaping these characters is the core defence for text content, but always use context-appropriate escaping for attributes, URLs, and scripts.

HTML entity escaper

Paste text to convert characters like <, >, &, and quotes into HTML entities so they display literally instead of being parsed as markup. Runs locally.

Loading tool…

What HTML escaping does

It replaces the five characters that are significant in HTML — ampersand, less-than, greater-than, and both quotes — with their entity equivalents so they render as text rather than markup.

Why escape HTML

Displaying user input or code samples without escaping can break your layout or open the door to injection. Escaping renders the raw characters safely.

Great for code samples

Escaping a snippet lets you paste it inside a page and have the tags show up literally instead of being interpreted by the browser.

How to html escape

Paste the text or markup you want to escape.
Click Convert to produce the escaped output.
Copy it into your HTML where it will display as literal text.

Related converters

URL EncodePercent-encode text for safe use in URLs and query strings.Base64 EncodeEncode text to Base64 with full UTF-8 support.HTML MinifierCollapse whitespace and strip comments to shrink HTML.