DocomintEscape HTML
Escape &, <, >, and quotes so user-supplied text is safe to render inside HTML.
The same operation as HTML Entity Encoder, written for the developer use case: escaping user-supplied or dynamic text before it's inserted into an HTML page, so a stray < or " can't break the surrounding markup or open an XSS injection point. In a real application, prefer your framework's built-in auto-escaping (React, Vue, and most templating engines do this by default) — this tool is for quick manual checks and one-off scripts.
Example: <script>alert("hi")</script> escapes to <script>alert("hi")</script> — safe to render as visible text instead of being interpreted as a tag.
How it works
- Paste text that will be inserted into an HTML page
- Reserved characters are converted to entities, instantly on your device
- Copy the escaped result — safe to render as literal text, not markup
Frequently asked questions
Does escaping HTML like this prevent XSS?
It removes the most common injection vector (breaking out of text content with < or "), but real XSS prevention depends on context — escaping rules differ for HTML attributes, JavaScript strings, and URLs. Use your framework's context-aware auto-escaping for production code.
Is my data uploaded anywhere?
No — Escape HTML runs entirely in your browser using JavaScript/WebAssembly. Your data is never sent to a server.
Does this escape single quotes (') as well as double quotes?
Yes — both are converted to their named entities (' and ") since either can terminate an HTML attribute depending on which quote style surrounds it.