HTML entity encode
HTML entity encode. Runs on your device, nothing is uploaded.
Runs on your device. The file is never uploaded.
HTML entity encode replaces exactly five characters in your text: ampersand, less-than, greater-than, double quote and apostrophe become &, <, >, " and '. Everything else, accents and emoji included, passes through unchanged. It is not a sanitiser, and text that lands inside a script or a style block needs its own escaping rules.
Questions
Which characters does it replace?
Five, and only five: ampersand becomes &, less-than becomes <, greater-than becomes >, double quote becomes ", and the apostrophe becomes '. Everything else in your file, including all letters, digits, spaces and other punctuation, is passed through untouched. Those five are what stop text from being read as markup or from closing an attribute early.
Why is the apostrophe a number and not '?
Because a numeric character reference works everywhere, including in older parsers and in XML contexts where the named form was never defined. ' and ' mean the same character, and the numeric one is simply the safer of the two to emit. Browsers render both identically, so you can substitute one for the other if a style guide asks.
Does it encode accents, symbols and emoji?
No. Characters outside those five are left as they are, so an accented letter or an emoji stays literal in the output. That is fine as long as the page it lands in is served as UTF-8, which is the normal case. If you need everything turned into entities, this is not that tool.
Is this enough to stop cross-site scripting?
It covers the characters that let text break out of HTML body content or a quoted attribute value, which is the common case. It is not a sanitiser, and it does nothing for text that lands inside a script block, a style block, a URL or an unquoted attribute. Those contexts need their own escaping rules.
Can it decode entities back to text?
Not here. The tool runs one way, and there is no matching decoder in this set. Any browser turns entities back into characters when it renders the page, and every templating library has an unescape helper. If you only need to read one string, put it in a page and look at the result.
Does the file get uploaded?
No. The replacement runs in a Web Worker on your device, with no network step at any point. Nothing is stored, no account exists, and the page continues to work after you go offline. Each file you drop is escaped separately, so you can process a folder of templates in one go.