Escape special characters for HTML text and quoted attributes. Show markup examples on a page without treating their angle brackets as tags.
How to use
Paste the text to escape and copy the encoded result. Use the result in the intended HTML text or attribute context.
Example
<p> becomes <p>, while an ampersand becomes &. Quotes are also escaped.
FAQ
Does it sanitize a full HTML document?
No. It escapes text and is not a general HTML sanitizer. JavaScript, CSS, and URLs need context specific handling.
Related tools
A practical task
For an HTML tutorial, encode the example code rather than the whole page containing the tutorial. Otherwise the layout tags become visible text too. Keep the encoded snippet separate from the trusted template that displays it.
Another useful question
Can I escape text twice?
A second pass also escapes the ampersands added by the first. Use the original source for each fresh encoding pass instead of repeatedly processing the output.
Details for interpreting the result
| Detail | Explanation |
|---|---|
| HTML character references | Character references such as & describe a character inside HTML. A reference can be escaped again when nested in another source. Decoding one layer is different from decoding every layer of a value. |
| HTML and plain text | HTML tags describe structure. Plain text displays characters without interpreting them as tags. Decide which result you need before removing markup, escaping brackets, or pasting output into an editor. |
| Escaping and sanitizing | Escaping represents special characters literally. Sanitizing removes or changes unsafe markup according to rules. Neither operation should be replaced by assuming that unknown input contains harmless display text. |
| Encoding and encryption | Encoding changes how data is represented so another system can read it. It does not require a secret key. Encryption protects information with a key, while hashing produces a digest for a different purpose. |
| Source boundaries | A summary or rewrite works from the material you provide. A URL alone does not supply the full article in this interface. Include the relevant passage and keep citations attached to the claims they support. |
| Preview boundaries | A restricted preview can block scripts, external images, fonts, and other resources. That keeps the preview separate from active page behavior, but it also means it is not a faithful copy of every production layout. |
| URL components | A URL contains structure such as scheme, host, path, query, and fragment. Characters that separate those parts differ from characters inside a value. Encode the right component rather than transforming the full address blindly. |