HTML Entities Encoder

Q: Does escaping break find-on-page?

No: the browser renders an entity as the plain character, and the browser's search matches what is rendered. Entities are only visible in the source — which is the second argument for not escaping what does not need escaping.

Written byOleh Soloninupdated 25 September 2026

Mode

Text

Result

Result
<div class="card">Hello & goodbye</div>
Length65

Five characters that break HTML if left alone

Convert angle brackets, ampersands and quotes into HTML entities, or decode entities back into readable text.

HTML reserves a handful of characters, and leaving them raw in content is how a stray < turns the rest of a page into a broken tag.

Escaping is also the baseline defence against cross-site scripting. Any user-supplied text rendered into a page must be escaped, or a submitted script tag becomes an executing one.

How to use

Paste the text or the HTML fragment and pick a direction — escape or unescape.
Escape anything that reaches the page from outside: comments, form fields, values out of a database.
Check the length: each replacement adds the entity's length minus one — & adds four characters, < adds three.

The five characters that matter

Five characters carry their own meaning in HTML: the ampersand opens every entity, the angle brackets delimit elements, and the two quote marks close attribute values. Leave them alone and user input can break out of an attribute and bring its own markup along — the classic route to cross-site scripting.

The order is not arbitrary. The ampersand has to go first, or the second pass destroys the entities the first one just made: < would turn into &lt;. Unescaping runs the same list backwards.

The calculator on this page performs all five. The single quote has no name in HTML 4, so the numeric form is used: ' arrived with HTML 5 and older processing chains do not recognise it.
Character	Entity	Why it is replaced
&	&	opens every entity
<	<	opens an element
>	>	closes an element
"	"	delimits an attribute value
'	'	delimits a single-quoted attribute

What the replacements cost

Escaping only ever adds characters, and the amount is predictable: three for an angle bracket, four for an ampersand, five for a double quote. The default example grows from 39 characters to 65, and all 26 of those come from seven replacements of four kinds of character.

Ordinary letters are untouched, accented ones included. With charset=utf-8 declared, a browser renders them directly, and turning them into entities would only make the source longer and harder to search.

Every row comes from the calculator on this page. The last one is the check in the other direction: only the ampersand changed, and the words around it were left exactly as they were.
Before	After escaping
5 < 6 & 7 > 6	5 < 6 & 7 > 6
"quoted"	"quoted"
O'Brien	O'Brien
Hello & goodbye	Hello & goodbye

What this calculator shows

Text with reserved characters converted to entities
Entities decoded back into plain characters
The resulting length, which grows noticeably when escaping

What to keep in mind

Escapes the five characters that matter: & < > " and '.
Decoding handles named entities and numeric references such as «.

FAQs

Which characters must be escaped?

Five: & < > " and the single quote. For text between elements and for quoted attribute values that is enough.

Does escaping prevent XSS?

For ordinary text between tags and for quoted text attributes, yes. Not for every attribute, though: href and src also need the URL and its scheme checked, because href="javascript:…" is dangerous even in quotes, and unchecked data must never go into an event handler such as onclick. Inside JavaScript, in a style attribute and in an unquoted attribute the rules are different, and an entity table does not help there.

What is the difference between " and "?

Nothing in meaning: one is named, the other numeric. The numeric form needs no list of names, so it also works where only the HTML 4 names are known.

Do I need to escape non-Latin text?

No. With charset=utf-8 any browser handles accented and non-Latin letters directly. Entities are only needed when some step in the chain does not carry the character set reliably — an old mail template, for instance.

Why is the ampersand replaced first?

Because every entity begins with one. Turn the less-than sign into < first and the ampersand into & second, and you get &lt; — the page then shows the text "<" instead of a less-than sign. Unescaping reverses the order for the same reason.

Does escaping break find-on-page?

No: the browser renders an entity as the plain character, and the browser's search matches what is rendered. Entities are only visible in the source — which is the second argument for not escaping what does not need escaping.

Worked example

A snippet of markup as text

Input: <div class="card">Hello & bye</div>

Output: <div class="card">Hello & bye</div>

Note: Escaped like this, a browser displays the markup instead of rendering it — which is exactly what a code example needs.

Useful links

All tools in Dev Tools

HTML Entities Encoder

Result

Related tools

URL Encoder / Decoder

Base64 Encoder / Decoder

Markdown to HTML Converter

JSON formatter and validator

Useful links