XSS-Safe Output Encoder

Encode text to prevent XSS vulnerabilities free online. Converts dangerous HTML, JavaScript, and URL characters into safe encoded equivalents for output in any context.

Text to encode

How to Use This Tool

Paste the text to encodeAdd any user-controllable text you're outputting

Choose the output contextSelect HTML, JavaScript, URL, or attribute encoding

Use the encoded outputApply this in your actual output, matching the right context

Encoding Defends Against XSS -- This Tool Does Not Attack Anything

Cross-site scripting happens when user-controllable text gets output into a page without proper encoding for its context, allowing an attacker's injected markup or script to execute as if it were trusted code. The defense is straightforward in principle -- encode special characters into their safe representations before output -- but the details matter enormously, since the right encoding depends entirely on where the text ends up.

This tool encodes text for four common output contexts, letting you see exactly what safe output should look like for HTML body content, JavaScript string literals, URLs, and HTML attributes.

Context-Specific Encoding Is Not Optional Detail

HTML-encoding text that ends up inside a JavaScript string literal does not protect against script injection in that context -- a JavaScript string needs its quotes and backslashes escaped differently than HTML needs its angle brackets escaped. Using the wrong encoding for the actual output context is one of the most common reasons XSS defenses fail despite encoding having technically been applied somewhere in the code.

Why Modern Frameworks Reduced, But Did Not Eliminate, This Problem

React, Angular, and Vue all auto-escape values inserted into templates by default, which is why manual encoding concerns have become less central to everyday frontend work. The remaining risk lives in the gaps -- raw HTML insertion methods (dangerouslySetInnerHTML, v-html), server-rendered templates without auto-escaping, and any code path that bypasses the framework's default protection.

Frequently Asked Questions

Defending. This encodes user-controllable text into safe representations before it gets output into HTML, JavaScript, or a URL, which is the standard defense against cross-site scripting (XSS). It does not generate, test, or execute any attack payloads against a target -- it only transforms text into a safe form for legitimate output.

Each output context has different special characters that carry meaning. In HTML, < and > define tags. In a JavaScript string literal, quotes and backslashes matter. In a URL, spaces and many symbols need percent-encoding. Using the wrong encoding for the context -- like HTML-encoding text destined for a JavaScript string -- can leave the underlying vulnerability open despite encoding having technically been applied.

Generally no, and this is a common mistake. Encoding should happen at output time, in the specific context where the data is being rendered, not at storage time. Storing pre-encoded data can cause double-encoding bugs and doesn't protect contexts the encoding wasn't designed for.

Proper output encoding closes the most common XSS vector, but a Content-Security-Policy header provides defense in depth in case encoding is missed somewhere. Modern frameworks (React, Angular, Vue) also auto-escape by default in templates, which is why manual encoding is now mostly needed for edge cases outside a framework's automatic protection.

The encoded output text is correct for the context you select, but you should still use your programming language or framework's built-in encoding functions in actual production code rather than copy-pasting from any external tool, since those functions are tested against the exact runtime environment your code executes in.