Loading…
Escape HTML special characters to prevent XSS attacks.
🌐 Escapes & < > " and '. Use before inserting user input into HTML to prevent XSS.
HTML escaping converts special characters (& < > ") into their entity equivalents (& < >), so they display correctly in a browser and prevent XSS attacks.
If user input contains <script> and you insert it into a page without escaping, the browser runs the script — a classic XSS (cross-site scripting) attack. Escaping turns it into harmless text that displays as <script>instead of executing.
& → & (must be escaped first)< → <> → >" → "' → 'Escaping rules differ by where text will appear. HTML body escaping (this tool) is different from attribute escaping, URL escaping, or JavaScript string escaping. Always escape for the specific context — using the wrong one can leave vulnerabilities.
The HTML Escape handles html escapedirectly in your browser. Paste or type your input, and the tool processes it instantly — no upload, no signup, no waiting. It's built for the moments when you need a quick transformation and don't want to leave your workflow.
Because the tool runs client-side, it's fast and private. Your text never touches a server, which makes it safe for sensitive content. The interface is keyboard-friendly and works on any device with a modern browser.
Common uses: people reach for this tool when they need to use a html escape special characters, html entity encoder online, escape html for xss prevention, or encode html ampersand and brackets.
Browser-based tools like this one have a few real advantages over installed software or manual methods:
More tools you might find useful