Text & code / MULTIVERTO
Escape text for HTML by turning &, <, > and quotes into entities. Useful when showing code as text.
Apply each text tool to the previous result.
01 / Guide
Special characters become HTML entities, such as & becoming & and < becoming <. This is not HTML sanitization.
Escaping text for an HTML text node does not make it safe in JavaScript, CSS, URLs or every HTML attribute. Use encoding suited to each context.
02 / Example
<p class="greeting">Hello & welcome</p><p class="greeting">Hello & welcome</p>03 / Guide
Use this direction when literal text should appear inside an HTML page without the browser treating angle brackets as tags. If you enter a snippet such as <b>hello</b>, the output contains references for the brackets, so a later HTML parser can display the snippet as text. The ampersand is escaped first; otherwise an existing entity-like sequence could be mistaken for markup during another pass. Quotes are also escaped by this tool, but that does not make the result universally safe in every kind of attribute or script.
Do not encode a whole trusted HTML document when you intend its tags to render: you would see tag characters instead of formatted content. For user-submitted comments, prefer assigning textContent or a framework’s safe text binding; those APIs manage the correct context. If the value will go into an href, a style rule or a JavaScript literal, choose an encoder or safe API for that specific destination rather than reusing HTML text escaping.
HTML reserves characters such as the ampersand and angle brackets for markup. Character references let a document represent those characters as data: for example, an ampersand can be written as &, while a less-than sign can be written as <. Browsers interpret references when parsing HTML. Named references and numeric references are both possible, but a reference is only meaningful in the context in which an HTML parser consumes it. Seeing entity-like text in a plain text file does not mean the file itself has been rendered as HTML.
The distinction between text content and executable markup matters. Showing user-supplied text safely inside a page is different from inserting a trusted fragment of HTML. Likewise, an HTML text node, an attribute, a URL attribute, a CSS rule and a JavaScript string have different escaping requirements. Entity conversion is a useful representation step, not a complete security policy or sanitizer. Keep untrusted input out of dangerous contexts, and use the templating or DOM APIs appropriate to the place where the value will be inserted.
Start with the original text and confirm that the receiving application actually asks for an encoded representation. Paste the text or load the example, then inspect the output before copying it. The conversion happens in this browser; the entered text is not uploaded to a conversion service. This direction changes how information is written, not the meaning of a sentence. Keep the source beside the result when debugging, and avoid applying an encoding twice unless the destination format explicitly requires two layers.
Keep the original input when you need to audit a result. An encoded representation may look very different from the underlying text, especially when accents, emoji, punctuation or line breaks are present. If you exchange the result with another program, check which character encoding and exact format that program expects. Try a short known example before processing a large value, and compare the output with the receiving application rather than assuming every similar-looking format is interchangeable.