Why encode HTML?
HTML encoding (also called HTML escaping) replaces characters that are structurally meaningful in markup — &, <, >, ", ' — with their entity equivalents, so the browser renders them as literal text instead of interpreting them as tags or attributes. It's the standard defense against stored/reflected XSS when you render user-supplied text inside HTML.
Basic vs. extended mode
Basic escapes only the five characters that are unsafe in HTML: & → &, < → <, > → >, " → ", and ' → '. This is enough to safely embed text inside an HTML document or attribute.
Extended additionally converts every non-ASCII character (accents, emoji, CJK, symbols) into a numeric character reference like é. Use it when you need output that's safe to store or transmit as plain ASCII — for example, legacy systems or email templates that mishandle UTF-8.
FAQ
Does this replace a proper templating engine?
No. Templating engines and frameworks (React, Vue, etc.) escape output automatically — use this tool for one-off conversions, debugging, or generating static snippets, not as a substitute for automatic escaping in your app.
Why isn't / encoded?
Some older escaping guides also encode forward slashes to harden against certain legacy parsers, but it isn't part of the standard five-character HTML escape set and modern browsers don't need it. It's left untouched here to keep output readable.