HTML Tools

HTML Encoder

Escape &, angle brackets, quotes, and apostrophes for literal HTML text/attribute contexts.

Text

HTML-encoded text

ReadyEscapes &, <, >, quotes, and apostrophes for literal HTML text/attribute contexts. It is not URL or JavaScript encoding.

Source & result review

Inspect what the browser parsed and what the tool produced

DOMParser ≠ sanitizer

Ready to inspect source and result.

Review is local and detached: this panel never inserts pasted markup into the live page. A browser parser can normalize malformed HTML, but successful parsing does not make markup safe to inject. Scripts, inline event attributes and embedded browsing/plugin elements are reported as active-content signals, not executed.

Browser-local does not mean standards-complete

HTML parsing is error tolerant. Source diagnostics, sandboxed previews, and transformations do not replace full conformance, security, or production-browser testing.

Entity encoding is context-specific

Encoding common HTML characters is useful for literal text and many quoted-attribute cases, but it is not a universal JavaScript, URL, CSS, or sanitizer boundary.

Parser and sanitizer boundary

HTML DOMParser creates a detached document and may repair or normalize markup. That is useful for inspection, but parsing alone does not sanitize untrusted HTML. Review scripts, inline event attributes, embedded content and application-specific URL/context rules before any live-DOM insertion.