HTML Encoder
Escapes the five characters that would otherwise be read as markup.
Results
What this tool does
To show a piece of HTML on a page as text rather than have the browser run it, the angle brackets and ampersands have to be replaced by their entities. It is the same operation that stops a comment field from becoming an injection point: text that arrives from outside is escaped before it is written into the page, so a script tag arrives as visible characters instead of as an instruction.
Formula
& < > " ' become & < > " '
Variables
| Symbol | Meaning | Unit |
|---|---|---|
text | Text | — |
OUT | Encoded | — |
SA | Size after | B |
Worked example
- Text<script>alert("olá")</script> & companhia
- Encoded<script>alert("olá")</script> & companhia
- Size after67 B
Limitations
- The calculation runs entirely in your browser. The values you type are never sent to a server.
Frequently asked questions
Is escaping enough to stop XSS?
It is the right tool in the right place, not a blanket answer. These five characters are what matters when untrusted text is written into the body of a page or into an attribute value. Text going somewhere else needs a different escaping: inside a script block, inside a URL attribute, inside a style rule, the rules are all different and HTML escaping alone will not save you. Escape for the context the text is going into, and prefer a template system that does it for you.