Skip to content
ENExplore Calculators

Output Encoding Calculator

Score context-aware output encoding across HTML, attribute, JavaScript, URL and CSS sinks, weighted by how dangerous each context is.

About Output Encoding Calculator

One escaping function cannot serve five contexts: HTML entity encoding is correct in a body, useless inside a script block and wrong for a URL, where the scheme must also be checked. The JavaScript context is weighted highest because it needs the strictest encoding and is the context developers most often get wrong. Encoding is where XSS is actually prevented or not, and the failures cluster in the contexts that framework auto-escaping does not cover — inline script, event handlers and href attributes.

Formula

Output Encoding

encoding score = 0.30 × JavaScript coverage + 0.20 × HTML body + 0.20 × attribute + 0.15 × URL + 0.15 × CSS, each the share of sinks in that context that are correctly encoded.

JavaScript coverage
Sinks inside script blocks or event handlers
URL coverage
Sinks in href, src or redirect targets

Worked example

With the default values below, Output Encoding Calculator returns Weighted Encoding Score of 67.3%. Change any input above and every figure here is recalculated in your browser.

Inputs used

HTML body sinksaccepts 0–100,000 sinks
320 sinks
HTML body sinks correctly encodedaccepts 0–100,000 sinks
300 sinks
HTML attribute sinksaccepts 0–100,000 sinks
140 sinks
Attribute sinks correctly encodedaccepts 0–100,000 sinks
105 sinks
JavaScript context sinksaccepts 0–100,000 sinks
45 sinks
JavaScript sinks correctly encodedaccepts 0–100,000 sinks
24 sinks
URL and href sinksaccepts 0–100,000 sinks
60 sinks
URL sinks correctly encoded and scheme-checkedaccepts 0–100,000 sinks
40 sinks
CSS or style sinksaccepts 0–100,000 sinks
12 sinks
CSS sinks correctly encodedaccepts 0–100,000 sinks
6 sinks

Results

Weighted Encoding Score
67.3%
Encoding Grade
C — Fair
Unencoded Sinks
102
Unencoded JavaScript Sinks
21
Weakest Context
CSS context
Recommended Action
Remove the 21 unencoded JavaScript sink(s) — prefer JSON serialisation over string interpolation

Step by step

  1. 1Values used
  2. 2Output Encoding
  3. 3Weighted Encoding Score= 67.3
  4. 4Encoding Grade= C — Fair
  5. 5Unencoded Sinks= 102
  6. 6Unencoded JavaScript Sinks= 21
  7. 7Weakest Context= CSS context
  8. 8Recommended Action= Remove the 21 unencoded JavaScript sink(s) — prefer JSON serialisation over string interpolation

Assumptions and limits

  • The result is derived only from the 10 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Output Encoding calculated?

encoding score = 0.30 × JavaScript coverage + 0.20 × HTML body + 0.20 × attribute + 0.15 × URL + 0.15 × CSS, each the share of sinks in that context that are correctly encoded. One escaping function cannot serve five contexts: HTML entity encoding is correct in a body, useless inside a script block and wrong for a URL, where the scheme must also be checked. The JavaScript context is weighted highest because it needs the strictest encoding and is the context developers most often get wrong.

Why does Output Encoding matter?

Encoding is where XSS is actually prevented or not, and the failures cluster in the contexts that framework auto-escaping does not cover — inline script, event handlers and href attributes.

What values do I need to enter?

This calculator takes 10 inputs: HTML body sinks, HTML body sinks correctly encoded, HTML attribute sinks, Attribute sinks correctly encoded, JavaScript context sinks, JavaScript sinks correctly encoded, URL and href sinks, URL sinks correctly encoded and scheme-checked, CSS or style sinks, CSS sinks correctly encoded. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

How should I put server data into a script block?

Serialise it as JSON and read it from the DOM rather than interpolating into JavaScript source. Emit it in a <script type="application/json"> block with HTML encoding, then JSON.parse the text content. That removes the need for JavaScript string escaping entirely, which is the part that goes wrong.

Related Calculators

Output Encoding Calculator | Calcrivo