HTML Encode

What is HTML Encode?

HTML Encode escapes the characters that have special meaning in HTML markup — so text containing them renders as literal text instead of being interpreted as tags or attribute boundaries. It's the standard defense against a stray < or & in user-supplied content breaking the page.

How it works

The encoder runs a single regex replace, s.replace(/[&<>"']/g, ...), swapping each of five characters for its named entity: & to &, < to <, > to >, " to ", and ' to '. Everything else — including non-ASCII text and emoji — passes through untouched, since only those five characters are structurally meaningful to an HTML parser.

Features

• Escapes all five HTML-significant characters: & < > " '
• Leaves all other Unicode text untouched
• Runs on keystroke or Cmd/Ctrl+Enter, entirely client-side
• Copy the escaped output directly into markup or an attribute value

Example

Input: <div class="tools">Fast & private</div>

Output:

<div class="tools">Fast & private</div>

Edge cases

Encoding text that's already entity-encoded ("double encoding") turns a literal & into &, which then displays wrong — only encode raw, un-escaped text. Encoding is also not a substitute for a proper HTML sanitizer: it protects text nodes and attribute values from breaking markup, but it doesn't understand HTML structure, so it's the wrong tool for cleaning already-formed but untrusted HTML.

Best practices

Encode at the point where dynamic text is inserted into HTML output, not earlier — encoding data before it's stored mixes presentation with content and makes the same value wrong to display anywhere that isn't HTML (a JSON API, a log file, a plain-text email). Most templating engines (JSX, Vue, Angular, Django templates) already auto-escape interpolated text, so this tool is most useful for one-off snippets, static site content, or debugging what a server actually sent.

Spec

WHATWG HTML — Named character references