In HTML text, escape < as < and & as &; escaping > as > is not strictly required but is standard practice. Inside an attribute value, also escape the quote character you used around the value: " as ", or ' as ' or '. When you need to do it by hand, for a snippet in documentation or a value in a template, PrismKit’s HTML entities encoder and decoder runs offline on Windows from a keyboard palette, so the text never goes into a web converter.
The rules below come from the WHATWG HTML standard and the OWASP Cross Site Scripting Prevention Cheat Sheet.
Encode and decode HTML entities offline, from a hotkey, without a browser tab.
Get it from Microsoft
Which characters must be escaped in HTML text?
The HTML standard says that the text of a normal element must not contain the character < or an “ambiguous ampersand”. In practice that gives two must-escape characters and one should-escape character:
| Character | Entity | Why |
|---|---|---|
< | < | Starts a tag; the standard forbids it in normal text |
& | & | Starts a character reference |
> | > | Not required in text, but escaped by convention and by the standard’s own serializer |
Every other character, including accented letters, emoji and symbols, can be written directly if the page is served as UTF-8. You do not need é for é.
What is an ambiguous ampersand?
The WHATWG standard defines an ambiguous ampersand as an & followed by one or more letters or digits and then a ;, where that sequence does not match a named character reference. So &foo; is an error, while & followed by a space is technically allowed.
That subtlety is why the safe rule is simply to escape every & as &. The standard’s list of named references also keeps some legacy names that are recognized without a semicolon, such as ©, so a pasted URL containing ©=1 can display with a © sign in body text. A product name like R&D; is an ambiguous ampersand and a conformance error. Writing & every time removes the guesswork.
What are the three kinds of character references?
The standard allows three forms, all starting with & and ending with ;:
| Kind | Example for < | Example for " |
|---|---|---|
| Named | < | " |
| Decimal | < | " |
| Hexadecimal | < | " |
Named references are case-sensitive: É and é are different characters. Numeric references work for any character, which is why the single quote is often written ' or '.
Which characters need escaping inside attribute values?
Attribute values have one more character to worry about: the quote that surrounds the value. The standard says a double-quoted value must not contain a literal ", and a single-quoted value must not contain a literal '. So:
<input value="She said "yes" & left">
<a title='It's fine'>Link</a>Unquoted attribute values are far stricter. The standard forbids whitespace, ", ', =, <, > and the backtick in them. OWASP’s advice is simply to always quote attribute values, with double or single quotation marks, and use an attribute encoder for what goes inside.
How does the HTML standard itself escape text?
The WHATWG parsing chapter includes an algorithm for escaping a string when HTML is serialized. It replaces:
&with&- a no-break space with
<with<and>with>- in attribute mode,
"with"
That is a useful reference for what a correct encoder outputs, though for security OWASP recommends also encoding ' in attribute contexts.
Format HTML, encode entities and test a regex from one offline palette.
Get it from Microsoft
Does escaping HTML prevent XSS?
It prevents it in the two contexts it was designed for: text between tags and ordinary quoted attributes such as title or value. For those, OWASP’s cheat sheet lists HTML entity encoding of &, <, >, " and ' as the control.
It does not make other contexts safe:
- Event-handler attributes. OWASP warns that HTML attribute encoding alone does not protect JavaScript in an attribute like
onclick, because the parser decodes the references before the script runs. - URLs, CSS and script blocks. Each needs its own encoding or validation. Our guide to URL encoding, %20 versus + covers the URL side.
- Raw HTML sinks. Assigning untrusted text to
innerHTMLparses it as markup.
The cheat sheet also points the other way: when you set text from JavaScript with textContent, or set an ordinary attribute with setAttribute, the browser does not parse HTML in the value. OWASP says to pass the original text without pre-encoding it, otherwise users see & on screen. The same applies to most template engines that escape automatically: encoding by hand on top of them double-encodes.
How do you show HTML code on a web page?
To display markup as text, for example in a tutorial, escape it so the browser does not parse it. Each < becomes < and each & becomes &, then the result goes inside a pre and code element. A snippet such as <b>Bold</b> is written in the page source as <b>Bold</b>, and the reader sees the original tags.
The pre element keeps line breaks and spacing, but it does not stop parsing. Tags inside it are still tags, which is why the escaping step cannot be skipped.
What are the common mistakes when escaping by hand?
| Mistake | What happens | Fix |
|---|---|---|
Escaping < but not & | Existing entities in the text, such as < in a code sample, display as < instead of as written | Escape & first, then < and > |
| Leaving quotes unescaped in attributes | The value ends early at the first matching quote | Escape " or ' to match the quoting |
| Unquoted attribute values | A space or > in the value breaks the attribute | Always quote attribute values |
| Using entities in a URL | & is correct inside an HTML href, but a URL typed into a browser needs percent encoding | Use URL encoding for URL parts, entity encoding for the HTML around them |
The order matters in the first row. If you replace < with < first and then replace &, you turn your own < into &lt;.
What does double encoding look like?
Double encoding happens when already-escaped text is escaped again:
| Step | Text |
|---|---|
| Original | Fish & Chips |
| Escaped once | Fish & Chips |
| Escaped twice | Fish &amp; Chips |
The page then shows Fish & Chips to the reader. The fix is to escape once, at output, in the layer that knows the context. Decoding the text to inspect it, then encoding once, is the quickest way to repair a value that has been through too many layers.
How do you encode or decode entities quickly?
For one-off work, such as preparing an HTML snippet for documentation, checking what a stored value really contains, or cleaning up a double-encoded string, an encoder is faster than doing it by eye.
PrismKit is a free, keyboard-first utility belt for Windows that sits in the background until you call it with a hotkey. Its Encoders & Decoders include Base64, URL, JWT inspection and HTML entities, and its formatters cover JSON, XML, SQL and HTML. It runs entirely offline, so the text you paste, which may include tokens or customer data, never leaves your PC. There is no tracking or telemetry.
Decode first if you are not sure what you have, then encode once. Check that the output escapes quotes when the value is going into an attribute. For the related Base64 and URL jobs, see our page on encoding and decoding Base64, URL and JSON.
Frequently asked questions
Do I need to escape the greater-than sign?
In text, the HTML standard does not require it, but escaping > as > is common practice and harmless.
Should I escape non-English characters?
No, if your page is UTF-8. Write them directly. Entities for letters like é are optional.
What is the entity for a non-breaking space?
, or numerically  .
Is ' valid HTML?
It is a named reference in HTML5, but ' or ' is the widely used choice, and it is what OWASP lists.
Try PrismKit
PrismKit is free in the Microsoft Store, with optional one-time expansion packs. Install it, set your hotkey, and encode your next snippet without opening a browser tab. More detail is on the PrismKit product page.
Keep everyday developer tools a hotkey away, offline, with a free core set.
Get it from Microsoft
Last updated 23 October 2026. Published by Automata Labs, a software company in Canada.