HTML Encode
Escape text so a browser prints it instead of running it.
About this converter
Five characters change how a browser reads a page: < > & " and '. Escaping them is what turns a snippet of markup into text a page will display rather than execute.
The default escapes exactly those five, which is what you want almost always — modern pages are UTF-8, and escaping an accented character into é just makes the source harder to read for no gain.
The second option escapes every non-ASCII character as a numeric entity. That is worth having when the output is going somewhere whose encoding you cannot rely on: an old email template, a system that mangles anything outside ASCII, a file whose charset header you do not control.
A word of caution: escaping is contextual. This produces text safe for HTML *content*. Text going into a URL inside an attribute, or into JavaScript, needs a different escape, and a templating engine that knows the context is a better answer than pasting into a tool.
Frequently asked questions
Is this enough to prevent XSS?
For text going into the body of a page, escaping those five characters is the right thing and does the job. But escaping depends on where the text lands — inside a URL attribute, inside a style block, or inside JavaScript, HTML escaping is not sufficient and can be actively wrong. Use your framework's contextual escaping for anything security-critical; this tool is for inspecting and hand-writing, not for building a defence.
Should I escape non-ASCII characters?
Usually not. Any page served as UTF-8 — which is effectively all of them — handles é, £ and emoji directly, and escaping them makes the source harder to read and edit. The option exists for output going into systems where the encoding is unreliable or unknown.
Why is ' escaped as ' rather than '?
' is defined in XML and HTML5 but not in HTML4, so older parsers do not recognise it. The numeric form works everywhere, which makes it the safer default when you do not control what reads the output.
Does what I paste get sent anywhere?
No. The conversion runs in your browser, on your own machine — that is why the result appears as you type rather than after a wait. Nothing is uploaded, nothing is logged, and closing the tab is the end of it. This matters more here than on most pages: tokens, keys and internal data get pasted into tools like this constantly, and most of them are a form that posts to a server.