DocomintHTML escapen
Escaped &, <, > und Anführungszeichen, damit nutzergenerierter Text sicher in HTML angezeigt werden kann.
What is a HTML escapen?
The same operation as HTML Entity Encoder, written for the developer use case: escaping user-supplied or dynamic text before it's inserted into an HTML page, so a stray < or " can't break the surrounding markup or open an XSS injection point. In a real application, prefer your framework's built-in auto-escaping (React, Vue, and most templating engines do this by default) — this tool is for quick manual checks and one-off scripts.
How to use the HTML escapen
- Paste text that will be inserted into an HTML page
- Reserved characters are converted to entities, instantly on your device
- Copy the escaped result — safe to render as literal text, not markup
Example
<script>alert("hi")</script> escapes to <script>alert("hi")</script> — safe to render as visible text instead of being interpreted as a tag.
Frequently asked questions
Does escaping HTML like this prevent XSS?
It removes the most common injection vector (breaking out of text content with < or "), but real XSS prevention depends on context — escaping rules differ for HTML attributes, JavaScript strings, and URLs. Use your framework's context-aware auto-escaping for production code.
Is my data uploaded anywhere?
No — HTML escapen runs entirely in your browser using JavaScript/WebAssembly. Your data is never sent to a server.
Does this escape single quotes (') as well as double quotes?
Yes — both are converted to their named entities (' and ") since either can terminate an HTML attribute depending on which quote style surrounds it.