Free HTML Entity Encode calculator with clear step-by-step results.
Escapes the five characters that carry syntactic meaning in HTML so they render as literal text instead of being parsed as markup. Ampersand must be replaced first, otherwise the ampersands introduced by the other replacements get double-encoded - which is the classic bug in hand-rolled escapers.
Mandatory replacements
& becomes &, < becomes <, > becomes >
Attribute-safe replacements
Double quote becomes " and single quote becomes '
Only inside attribute values, but escaping them everywhere is safer and costs almost nothing. Unescaped quotes in an attribute are a common cross-site scripting vector.
Not if the document is served as UTF-8, which it should be. Numeric references are only useful for legacy pipelines that cannot carry the bytes intact.