Type or paste text to escape it for HTML. & and < become & and <, and quotes are escaped too so the result is safe inside an attribute. Choose + non-ASCII to write accents and emoji as numeric references for pure-ASCII output.
Encode a file:
Inside HTML, & and < must always be escaped as & and <, and inside an attribute value the quote that wraps it must be escaped too. The Text + attrs variant escapes all five (& < > " '), which is safe in both places and is what server-side escapers do. Measured on Tom's <b>"A&B"</b>:
html.escape(): Tom's <b>"A&B"</b>htmlspecialchars(): the same, but with ' for the apostrophe. Invalid UTF-8 input is silently replaced by U+FFFD (�), so a Latin-1 é is lost rather than reported.htmlentities() also turns every accented letter and symbol into a named entity (café — 5€). On a UTF-8 page that is unnecessary; the + non-ASCII variant writes numeric references (é) instead, for the rare case where the output must be pure ASCII (old email systems, a page served as Latin-1).Text only leaves quotes as they are, which is fine between tags but unsafe inside an attribute. JavaScript has no built-in escaper: setting textContent instead of innerHTML avoids the need for one.
An unescaped & in a URL is the classic decoding surprise. HTML recognizes some old entities even without the closing semicolon, so in page text ?id=1©=2&lang=en¬=3 is read as ?id=1©=2&lang=en¬=3. Measured in Chromium: the same string in an href attribute is kept as it is, but as text it gets the © and ¬. Python's html.unescape() gives ©=2 too; PHP's html_entity_decode() leaves it alone. This decoder works like page text and warns when a &name= was swallowed, so you can tell a URL from escaped text. In your HTML, write such URLs with &.
&lt; on the page. When the decoded result still contains entities, this page says so and offers to decode again.' in PHP: html_entity_decode() with its default HTML 4.01 table leaves ' undecoded (measured on PHP 8.5). Pass ENT_QUOTES | ENT_HTML5. This page uses the browser's full HTML5 table (2,231 entries). decodes to U+00A0, which looks like a space but is not equal to ' ', so string comparisons and splits on spaces fail. The decoder counts them.Decoding runs in your browser and never runs scripts: <script> or onerror in the input stays plain text.
Shotmint is a screenshot and PDF API. POST https://shotmint.creasework.com/v1/pdf with {"html": "…"} returns a PDF, and /v1/screenshot returns a PNG of any URL or HTML, rendered in real Chromium (1 credit each; 25 free renders a month, then €5 for 2,000 that never expire). Add response=url to get a link instead of the bytes, or put the URL in a query string with the encoding above. Scripts, AI agents and Make or Zapier can get a key with a bare POST https://shotmint.creasework.com/v1/keys/free (no body, JSON reply); request bodies are described in openapi.json.
Get 25 free renders a month API docs
Is my text uploaded? No. Encoding and decoding run in your browser and nothing is sent to a server, so tokens, API keys and private data stay on your device.
Is Base64 encryption? No. Anyone can decode it; it only turns bytes into text that survives email, JSON and URLs, and makes the data about 33% bigger.
Related tools: Base64 encoder, Base64 decoder, JWT decoder, URL encoder, URL decoder, Text to hex converter, Hex to text converter, HTML entity decoder, JSON formatter, Image to Base64, Base64 to image.
Base64 Encode · URL Encode · PDF to HTML · HTML to image · HTML to PDF · HTML formatter · Word to HTML · HTML to Markdown · HTML to Word · Markdown to HTML · Online HTML editor · HTML viewer · HTML Decode · HTML Minifier · HTML Beautifier · HTML to DOCX · HTML to JPG Converter · HTML to PNG Converter · all free tools