Is the HTML encoder free?
Yes. It is completely free to use, with no signup, no account, and no paywall.
Do I need to install anything?
No. It runs in any modern browser on desktop or mobile, with nothing to download and nothing to configure.
Does it stay local?
Yes. The text you paste is processed entirely in your browser and never uploaded to a server.
Is HTML encoding enough to prevent XSS?
Only for the specific case of inserting untrusted text into HTML element content or a quoted attribute value. Those are the most common cases, so escaping goes a long way, but it is not a complete defence. A value placed inside a script tag, inside a style rule, inside an event handler attribute, or as the target of an href needs different handling entirely, and escaping the quotes in a javascript: URL does not disarm it. The reliable approach is to never build HTML by string concatenation and to let your framework escape by default.
Why are only five characters escaped?
Because those five are the only ones that can change the meaning of HTML. The less-than and greater-than signs start and end tags, the ampersand starts an entity, and the two quote characters end attribute values. Everything else is inert in HTML content. Escaping additional characters, which some older tools do, adds bytes and hurts readability without adding safety.
Should I escape accented characters and emoji as entities?
No, not on a modern page. Any document served with a UTF-8 charset renders those characters directly, and converting them to numeric entities makes the HTML larger and much harder to read or search. Entity encoding of non-ASCII text is a legacy practice from an era of unreliable encoding declarations. Set the charset correctly and leave the characters alone.
Why must the ampersand be escaped before the other characters?
Because every escape sequence begins with an ampersand. If you escaped the less-than sign to < and then went back and escaped ampersands, you would rewrite the ampersand you had introduced and produce &lt;, which the browser renders as the visible text < rather than as a less-than sign. Order matters, and getting it wrong is the classic double-escaping bug that makes entity codes appear on the page.
Does my text get sent anywhere?
No. The replacement happens in your browser with a single local pass over the string. Nothing is uploaded or stored.