HTML Entity Encoder

This tool takes any text you paste and rewrites the five characters that have special meaning inside HTML: the ampersand, the less-than and greater-than signs, the double quote, and the apostrophe. The most common reason to reach for it is placing untrusted or unpredictable text into a static page, template, or email signature where a stray < or & would otherwise break the markup or be misread by the browser as the start of a tag.

Concrete cases that genuinely fit: quoting a user's comment, a product name, or a code sample inside hand-written HTML; pasting a snippet that itself contains tags so it displays as literal text rather than rendering; preparing a string for an HTML attribute (a title, alt text, or value) where an embedded quote would close the attribute early; and hardening copy that flows into a CMS field or a documentation page. It is equally useful for authors and editors who need to show example HTML on a page without it being interpreted.

If your text only contains plain letters, numbers, and spaces, you do not need this tool at all. It earns its place specifically when the content carries angle brackets, ampersands, or quotation marks that must survive intact when the page is parsed.

The flow is direct: paste or type into the Input box, then press Run (or Command/Control + Enter). The escaped result appears in the read-only Output box, where you can Copy it to the clipboard or Download it as a plain-text file named formatos-html-entity-encoder.txt. A sample is loaded on first visit so you can see the transformation immediately; Reset restores it and Clear empties the output. Everything happens in your browser, so nothing is uploaded and nothing remains after you close the tab.

What it supports is deliberately narrow and predictable. It converts & to &, < to <, > to >, " to ", and ' to ', and it escapes the ampersand first so existing entities are not double-mangled. That set is exactly what HTML body text and attribute values require, and it is safe to apply to a whole block at once.

What it does not do is just as important. It is a one-way encoder, not a decoder (use the companion HTML Entity Decoder for the reverse). It does not parse or validate HTML, does not pretty-print, and does not accept file uploads, so paste your text rather than dragging a document onto it.

The biggest thing to understand is that this encoder does not convert non-ASCII characters to numeric entities. Accented letters, em dashes, curly quotes, the euro or copyright sign, and emoji all pass through unchanged as their raw UTF-8 form. That is fine for a modern page served as UTF-8, but if your target context expects pure ASCII or uses a different charset, those characters can appear garbled even though the five reserved characters were handled correctly.

A frequent mistake is treating this as a complete cross-site-scripting defence. Escaping the five HTML characters protects HTML element and attribute content, but it is not the right encoding for inserting text into a <script> block, a JavaScript string, a URL, an inline style, or a CSS context, each of which has its own escaping rules. Use it for the case it is built for, not as a blanket sanitizer.

Two smaller pitfalls: do not run already-escaped text through it again, since the ampersands in existing entities will be re-encoded into &lt; and similar. And because the single quote becomes the numeric ' rather than ', the output is broadly compatible but will not look identical to encoders that emit named entities.

Scan the output and confirm that every < and > from your original now reads as < and >, that quotes inside attribute values are escaped, and that you have not accidentally fed in text that was already encoded. Paste the result into its intended HTML context and view it in a browser: the characters should display as literal symbols, not trigger tags or break the surrounding markup. If you see &lt; appearing on the page, that is the signature of double-encoding, and you should re-run from the clean source.

Pay particular attention to any non-ASCII characters, since they are left as-is. Verify your page or document declares a UTF-8 charset, and check those characters render as intended; if the destination is not UTF-8, convert or replace them separately before publishing.

For anything official, financial, or legal, treat the escaped text as a draft and verify it manually against the source. This tool performs a mechanical character substitution and makes no claim about preserving meaning, formatting, or completeness, so a human should confirm the final output reads correctly in its real environment before it is relied upon.