Skip to main content

HTML Entity Encoder

English

Convert special characters to HTML entities and back.

→ URL Encoder→ Base64
All calculations performed locally in your browser. No data sent to server.

Results are for informational purposes. Verify results with other sources.

Escape the ampersand last and you corrupt every entity you just wrote

HTML escaping has five characters and one rule about order. The ampersand must go first, because every replacement that follows introduces new ampersands. Escape it last and < becomes < — the page displays the entity text instead of the character, and the bug looks like a mangled template rather than a sequencing mistake.

How it works

  • Converts the characters that carry meaning in HTML into their entity forms, and back.
  • Applies the replacements in the order that avoids double-escaping.
  • Covers the five predefined entities plus numeric references for everything else.
&  →  &      MUST be replaced first
<  →  &lt;
>  →  &gt;
"  →  &quot;
'  →  &#39;

anything else:  &#DECIMAL;  or  &#xHEX;

Worked example

The string <b>a & b</b> escaped correctly, then with the ampersand handled last.

  1. correct order → &lt;b&gt;a &amp; b&lt;/b&gt;
  2. ampersand last → &amp;lt;b&amp;gt;a &amp; b&amp;lt;/b&amp;gt;
  3. every entity from the earlier steps got escaped again
  4. the browser then renders the literal text &lt;b&gt; on the page

One reordered line turns working output into visible entity codes. The five replacements are trivial individually; the only thing that can go wrong is doing them in the wrong sequence.

Reading the result

  • Escaping is context-dependent and this covers one context. A value that is safe in element text is not automatically safe in an attribute, a URL, inside a script block or in CSS — each needs its own escaping applied where it is used.
  • &apos; is defined in XML but was not in HTML 4, which is why &#39; is the safer numeric form for a single quote in HTML output that may be consumed by older parsers.
  • Attribute values need quote escaping specifically. An unescaped double quote inside a double-quoted attribute ends the attribute early, which is the mechanism behind a large share of injection through templates.
  • Escaping is not sanitising. It renders markup inert by displaying it as text; it does not decide whether the content was acceptable in the first place, and a system that needs to allow some HTML needs a parser and an allow-list, not an escaper.

Common questions

Why is my page showing &lt;b&gt; as text?
The content was escaped twice, most often because the ampersand rule ran after the others or because a value already escaped upstream was escaped again by the template. Find the layer doing it redundantly rather than decoding at the end.
Do I need to escape all five characters?
In element text, the ampersand and the angle brackets are the minimum. Inside attribute values you also need the quote characters, and since escapers rarely know which context they are feeding, handling all five is the safe default.

Sources