OWASP Java Encoder
Contextual output encoding for Java 8+ to help prevent XSS. Version 1.6.0 provides a zero-dependency core, String and Writer APIs, and optional javax/Jakarta JSP adapters.
Version 1.6.0 supports literal text inside ordinary, untagged JavaScript template literals, using the encoder for the surrounding context. This support was introduced in 1.5.0; do not use 1.4.1 for template-literal text.
Inside an HTML script block:
const greeting = <%= Encode.forJavaScriptBlock(message) %>;
Do not use encoded output in tagged templates (including String.raw), in ${...} expression bodies, or after an unfinished escape sequence. Supply the trusted delimiters and encode the complete value where possible. forJavaScriptBlock is not for HTML attributes or JSON.
For JSON string content, use Encode.forJson and supply double quotes. Prefer a serializer for complete JSON documents. For safe HTML embedding, encode each complete JSON string value and member name, including trusted text; forJson does not provide JavaScript-style protection for arbitrary mixed fragments.
Project Resources
- Documentation
- GitHub
- Cross Site Scripting prevention cheatsheet
- Encode 1.6.0 Javadocs
- Output contexts and security boundaries
- Release verification guide
- Compatibility and runtime matrix
- Maven Central — encoder 1.6.0
- encoder-1.6.0.jar
- encoder-jakarta-jsp-1.6.0.jar
- encoder-jsp-1.6.0.jar
- Security policy and private vulnerability reporting
- ESAPI adapter retirement and migration guide
- v1.6.0 release notes, signatures and checksums
- 1.5.0 security and migration notes
Project Leaders
Jeremy Long
Project Leader
Jeremy Long co-leads OWASP Java Encoder and coordinates project maintenance, releases, and security response with Jim Manico.
Jim Manico
Project Leader
Jim Manico is the founder of Manicode Security, where he trains developers and organizations in secure coding. He is an OWASP Distinguished Lifetime Member, a Java Champion, and the author of Iron-Clad Java. He leads the OWASP AISVS, Cheat Sheet Series, Java HTML Sanitizer, and Java Encoder projects.
Major Contributors
Recognizing key contributors who have made significant impact on this project.
Jeff Ichnowski
Original Author
Original author of OWASP Java Encoder.
Project Information
Requirements
- Java 8 or later at runtime
Slack