XSS Encoding Helper

Encodes text for safe use in an HTML attribute, a JavaScript string literal, and a URL, all at once. Runs entirely in your browser — nothing is sent to a server.

Ad placeholder: Resp_Horizantal_1 (horizontal)
Ad placeholder: Resp_Square_1 (square)

Encodes text for safe use in an HTML attribute, a JavaScript string literal, and a URL, all at once. Runs entirely in your browser — nothing is sent to a server.

Use cases

  • Safely embedding untrusted text inside an HTML page
  • Checking how a string would be encoded across different output contexts

Examples

A script tag

<script>alert('xss')</script>
HTML: &lt;script&gt;alert(&#39;xss&#39;)&lt;/script&gt;
JS: \x3Cscript\x3Ealert(\x27xss\x27)\x3C\x2Fscript\x3E
URL: %3Cscript%3Ealert('xss')%3C%2Fscript%3E

FAQ

Is my data sent to a server?

No — this tool runs entirely in your browser.

Related tools