Which characters must I encode?

At minimum: & " '. Encoding these prevents accidental tag creation and attribute-breaking in HTML output.

Is HTML encoding enough to prevent XSS?

No. HTML encoding helps for text content, but attributes, URLs, JavaScript, and CSS each need context-specific escaping.

Numeric or named entity — which should I pick?

Named entities are more readable; numeric entities work in any XML parser. For HTML5, either is fine.

$html-encoder

Encoders

Encode special characters to HTML entities or decode HTML entities back to text. Supports named entities (&) and numeric entities (&). Everything runs in your browser.

Mode:

Text / HTML Input

Standard Encode

Encodes & < > " and ' to named HTML entities. Use for escaping user content in HTML.

Output will appear here

Full Encode

Also converts non-ASCII characters (é, ñ, ü, etc.) to numeric entities. Use when the target charset is ASCII-only.

Output will appear here

HTML Entity Reference

Character	Named	Decimal	Description
&	&	&	Ampersand
<	<	<	Less than
>	>	>	Greater than
"	"	"	Double quote
'	'	'	Single quote / apostrophe
			Non-breaking space
©	©	©	Copyright
—	—	—	Em dash