Is this enough to prevent XSS?

Encoding is the right mechanism, but context decides which encoding. Escaping for HTML text does not make a value safe inside an attribute, a URL or a script block. Use your framework's context-aware escaping rather than pre-encoding by hand.

HTML Entity Encoder

Escape text so it renders literally inside HTML.

Loading tool…

About this tool

Replaces characters that would otherwise be read as markup with their entity equivalents, so text displays as written instead of being parsed as HTML.

Questions

Is this enough to prevent XSS?: Encoding is the right mechanism, but context decides which encoding. Escaping for HTML text does not make a value safe inside an attribute, a URL or a script block. Use your framework's context-aware escaping rather than pre-encoding by hand.

Privacy

This page does its work in your browser. What you paste is processed by JavaScript running on your own device and is never sent to a DevToolery server — there is no server that could receive it. The page itself is a static file delivered by a CDN. See exactly what is stored.