When should I HTML-encode user input?

Always, before inserting user-controlled text into HTML — it prevents XSS attacks. Most frameworks (React, Vue, Svelte) encode automatically; you mostly need this when building HTML strings manually.

What's the difference between < and <?

Both render as <. < is a named entity; < is a numeric entity. Numeric entities work for every Unicode code point; named entities only exist for a few hundred characters.

Will encoding break my page layout?

No — browsers render encoded entities as the original character. The encoded source is just safer to store and transmit.

HTML Encoder — Free Online Tool

What is the HTML Encoder?

The HTML Encoder is a free online html tools from Markvibe. Convert HTML special characters to entities. It runs entirely in your browser — your data never gets uploaded — and works on desktop, tablet and mobile with no sign-up.

Reviewed by The Markvibe Team · Last updated 2026-06-28

Example

A worked example so you know exactly what to expect.

Input

<a href="/">Home & About</a>

Output

&lt;a href=&quot;/&quot;&gt;Home &amp; About&lt;/a&gt;

How to use HTML Encoder

1Paste raw HTML or any string that contains <, >, &, " or '.
2Choose minimal encoding (only the five XML-reserved characters) or aggressive encoding (every non-ASCII character → numeric entity).
3The output is safe to drop directly into HTML source, an attribute value, or a JSON string in a script tag.
4Copy the result and paste into your template, CMS or email.
5Need the reverse? Use our HTML Decoder.