MMaxTools

HTML Encoder

Escape text for safe HTML — encode &, <, >, quotes and non-ASCII.

The HTML Encoder escapes text so it displays literally inside HTML instead of being interpreted as markup. Ampersands, angle brackets and quotes become entities — &lt;, &amp;, &quot; — that browsers render as plain characters.

Escaping is the difference between user input breaking a page and displaying safely: a comment containing <script> would execute without escaping, and raw ampersands can corrupt URLs and validation. This is why templating systems escape everything by default.

Two modes cover the use cases: the minimal mode escapes the five characters that matter in HTML contexts; the full mode additionally converts every non-ASCII character to a numeric entity, which helps when the target encoding is unknown. Processing happens locally.

How to use the HTML Encoder

  1. Paste the text or code snippet you want to display in HTML.
  2. Choose minimal or full encoding.
  3. Read the escaped output.
  4. Copy it into your HTML source.
  5. Render it to confirm it displays as literal text.

Frequently asked questions

Which characters must be escaped in HTML?

&amp; &lt; &gt; &quot; and &#39; (ampersand, less-than, greater-than, double and single quotes). The ampersand must be escaped first or it can corrupt the other entities.

When should I use full numeric encoding?

When your text contains non-ASCII characters (accents, emoji, symbols) and you want an ASCII-safe representation — useful for legacy systems or when the character encoding of the target is uncertain.

Is escaping the same as sanitizing HTML?

No — escaping makes untrusted text safe to display as text. Sanitizing (used for rich content) strips dangerous tags while allowing safe markup. If you need to allow formatting, use a sanitizer instead.