When should I encode HTML?

When displaying user input inside a page so it cannot break the markup.

It is one layer of defense; always combine with server-side validation.

🌐

HTML Encode

Escape <, >, &, quotes and apostrophes so text shows literally in HTML. Local, free, no signup.

No signup100% in your browserFree forever

TEXT

ENCODED

When should I encode HTML?: When displaying user input inside a page so it cannot break the markup.
Does it prevent XSS?: It is one layer of defense; always combine with server-side validation.