OWASP Java Encoder
Contextual output encoding for Java 8+ to help prevent XSS. Version 1.6.0 provides a zero-dependency core, String and Writer APIs, and optional javax/Jakarta JSP adapters.
OWASP Java Encoder helps Java applications safely render untrusted text in HTML, JavaScript, JSON strings, CSS, XML, and URL components. Choose the method for the destination parser context and encode at the output boundary. The core has no runtime dependencies; optional JSP adapters integrate with javax and Jakarta containers.
Version 1.6.0, released October 18, 2026, is available from Maven Central. It reduces unnecessary JavaScript letter escaping while preserving recognized HTML-token protection across trusted fragments. Encoded bytes and low-level streaming behavior change; review the release notes when upgrading. The security fixes introduced in 1.5.0 remain in effect.
Start with org.owasp.encoder:encoder:1.6.0. For JSP, use one matching adapter: encoder-jsp or encoder-jakarta-jsp, keeping versions aligned. Java 8 or later is required at runtime. The library is licensed under BSD 3-Clause.
Encoding is one part of XSS prevention. It does not sanitize HTML, validate URLs, or replace safe templates and other application controls. See the How to Use and Deploy tabs, current documentation, and XSS Prevention Cheat Sheet.
Contributing and Security
Contributions are welcome through the GitHub repository. Read CONTRIBUTING.md and BUILDING.md, use JDK 17 with the committed Maven wrapper, and run ./mvnw clean verify. The library runtime baseline remains Java 8.
Report ordinary bugs through GitHub Issues. Report suspected vulnerabilities privately through GitHub Security Advisories, not public issues or pull requests. If GitHub reporting is unavailable, email jeremy.long@owasp.org and jim.manico@owasp.org. Include the affected version, method, input, output context, and a minimal reproduction.
Only the latest 1.x release receives security fixes. The current supported version is 1.6.0. The retired encoder-esapi adapter has no supported version.
Project Resources
- Documentation
- GitHub
- Cross Site Scripting prevention cheatsheet
- Encode 1.6.0 Javadocs
- Output contexts and security boundaries
- Release verification guide
- Compatibility and runtime matrix
- Maven Central — encoder 1.6.0
- encoder-1.6.0.jar
- encoder-jakarta-jsp-1.6.0.jar
- encoder-jsp-1.6.0.jar
- Security policy and private vulnerability reporting
- ESAPI adapter retirement and migration guide
- v1.6.0 release notes, signatures and checksums
- 1.5.0 security and migration notes
Project Leaders
Jeremy Long
Project Leader
Jeremy Long co-leads OWASP Java Encoder and coordinates project maintenance, releases, and security response with Jim Manico.
Jim Manico
Project Leader
Jim Manico is the founder of Manicode Security, where he trains developers and organizations in secure coding. He is an OWASP Distinguished Lifetime Member, a Java Champion, and the author of Iron-Clad Java. He leads the OWASP AISVS, Cheat Sheet Series, Java HTML Sanitizer, and Java Encoder projects.
Major Contributors
Recognizing key contributors who have made significant impact on this project.
Jeff Ichnowski
Original Author
Original author of OWASP Java Encoder.
Project Information
Requirements
- Java 8 or later at runtime
Slack