Encode five HTML-sensitive characters as entities.
An optional suggestion for your wider workspace: a security key can be used with online accounts that support it. This tool does not require one.
You do not need to buy anything to use this free tool.
As an Amazon Associate I earn from qualifying purchases.
A USB-C and NFC security key supporting FIDO2/WebAuthn and FIDO U2F authentication.
Check service and device support; this FIDO-only model does not provide OATH codes or PIV and cannot recover an unregistered account.
Links open external sites. Check the exact model and seller in Amazon results; prices and availability can vary by country.
Enter your values. Your result will appear here.
The link opens this page only. Your files, inputs and private results are not shared.
<b>Hello</b> → <b>Hello</b>
Escapes &, <, >, double quotes, and apostrophes. It is not a sanitizer or a substitute for context-specific escaping in scripts, CSS, or URLs. Inputs are limited to 200,000 UTF-16 code units. Text is processed locally.
Image and text processing happens in your browser. Your files are not uploaded to our servers.
Try the small example on this page first. If it works, check your input format and size limit. Save any needed input before reloading. You do not need to share a file or password to report an issue.
Practical examples, settings and limits to help you finish the task.
Trace a harmless label through raw text, HTML source and rendered output; repair the wrong layer without repeatedly decoding unknown content.
Learn when to use URL encoding or decoding, compare %20 with +, and test query values, Unicode and double encoding with working examples.
Allow optional analytics cookies? Your files and tool inputs are excluded.
Google Analytics + PostHog + Cloudflare Web Analytics
Tool starts, completions, errors and first download requests are measured. Sent: tool, language and a random temporary attempt ID. Inputs and results are never sent.
With your permission, KitForma also measures public pages, only general section names for private areas such as accounts, and selected action categories on its own server. These analytics are visible only to the site owner. A random tab identifier renews after 30 minutes of inactivity or at most 24 hours; measurement records are kept for up to 31 days. Account IDs, entered content, files, query text and private page addresses are not sent. Withdrawing consent stops these consented measurements.
A separate server counter keeps daily public HTML page access totals even when analytics is declined, without cookies, browser storage or person/session identifiers. This counter does not store IP addresses; network processing for page delivery still occurs. Anonymous counter scope and 31-day retention
With consent, a guide-to-tool click can be linked to that attempt’s result using only public guide/tool codes and a random click code. Fixed campaign labels and recognized referring-source categories can also be used; referring search terms and full addresses are excluded. This context stays in the same tab for at most 30 minutes; filenames, search text and account identity are excluded. Withdrawing consent clears it.
PostHog measures tool usage and technical error categories without personal content, and checks whether optional feedback is enabled. Survey answers are sent only when you submit them. Session replay and automatic click/form tracking are off; account details, files and entered content are excluded.
After consent, Cloudflare Web Analytics measures public page visits and loading times without analytics cookies. Account, support, billing and Etsy areas, URLs containing queries or fragments, and analytics tests are excluded. DNT/GPC signals block collection.
PostHog uses a random identifier stored only for this tab’s session, renewed after 30 minutes of inactivity or at most 24 hours. Withdrawing consent clears it and stops new measurement. An earlier Google Analytics choice does not grant permission for PostHog.
Privacy details