OWASP Java Encoder Project

September 11, 2026 · View on GitHub

Contextual Output Encoding is a computer programming technique necessary to stop Cross-Site Scripting. This project is a Java 8+ simple-to-use drop-in high-performance encoder class with little baggage.

For more detailed documentation on the OWASP Java Encoder please visit https://owasp.org/www-project-java-encoder/.

Start using the OWASP Java Encoders

You can download the core library from Maven Central.

JSP tags and EL functions are also available from Maven Central:

encoder-jakarta-jsp - Jakarta Servlet 5.0+
encoder-jsp - legacy javax.servlet API

The jars are also available in Central:

<dependency>
    <groupId>org.owasp.encoder</groupId>
    <artifactId>encoder</artifactId>
    <version>1.4.0</version>
</dependency>

<!-- using Servlet Spec 5 in the jakarta.servlet package use: -->
<dependency>
    <groupId>org.owasp.encoder</groupId>
    <artifactId>encoder-jakarta-jsp</artifactId>
    <version>1.4.0</version>
</dependency>

<!-- using the Legacy Servlet Spec in the javax.servlet package use: -->
<dependency>
    <groupId>org.owasp.encoder</groupId>
    <artifactId>encoder-jsp</artifactId>
    <version>1.4.0</version>
</dependency>

Quick Overview

The OWASP Java Encoder library is intended for quick contextual encoding with very little overhead, either in performance or usage. To get started, add the encoder dependency shown above and import org.owasp.encoder.Encode.

Example usage:

PrintWriter out = ...;
out.println("<textarea>" + Encode.forHtml(userData) + "</textarea>");

Please look at the javadoc for Encode to see the variety of contexts for which you can encode.

Happy Encoding!

Building

Due to test cases for the encoder-jakarta-jsp project Java 17 is required to package and test the project. Simply run:

mvn package

To validate that the Jakarta JSP tags and EL functions work correctly, run the integration test:

mvn verify -PtestJakarta

The integration test requires a running Docker-compatible container runtime.

Java 9+ Module Names

JAR	Explicit JPMS Module	Automatic-Module-Name
encoder	owasp.encoder	org.owasp.encoder
encoder-jakarta-jsp	owasp.encoder.jakarta	org.owasp.encoder.jakarta
encoder-jsp	owasp.encoder.jsp	org.owasp.encoder.jsp
encoder-esapi	owasp.encoder.esapi	org.owasp.encoder.esapi

The multi-release descriptors define the explicit Java 9+ module names. The manifest names intentionally retain their historical values for consumers that disable multi-release support or otherwise use automatic-module discovery.

TagLib

Lib	TagLib
encoder-jakarta-jsp	<%@taglib prefix="e" uri="owasp.encoder.jakarta"%>
encoder-jsp	<%@taglib prefix="e" uri="https://www.owasp.org/index.php/OWASP_Java_Encoder_Project"%>

Development

The OWASP Java Encoder project is a multi-module Maven project:

$ mvn package

Benchmarks (currently in need of improvement) can be run with:

$ mvn verify -Pbenchmarks

Releases are done via central-publishing-maven-plugin:

mvn clean deploy -DperformRelease=true

News

2025-11-17 - 1.4.0 Release

The team is happy to announce that version 1.4.0 has been released!

feat: add XML 1.1 encoding support #88.

2024-08-20 - 1.3.1 Release

The team is happy to announce that version 1.3.1 has been released!

fix: add OSGi related entries in the MANIFEST.MF file #82.
fix: java.lang.NoSuchMethodError when running on Java 8 #80.

2024-08-02 - 1.3.0 Release

The team is happy to announce that version 1.3.0 has been released!

Minimum JDK Requirement is now Java 8
- Requires Java 17 to build due to test case dependencies.
Adds Java 9 Module name via Multi-Release Jars #77.
Fixed compilation errors with the ESAPI Thunk #76.
Adds support for Servlet Spec 5 using the jakarta.servlet.* #75.
- taglib : <%@taglib prefix="e" uri="owasp.encoder.jakarta"%>

2020-11-08 - 1.2.3 Release

The team is happy to announce that version 1.2.3 has been released!

Update to make the manifest OSGi-compliant #39.
Update to support ESAPI 2.2 and later #37.

2018-09-14 - 1.2.2 Release

The team is happy to announce that version 1.2.2 has been released!

This is a minor release fixing documentation and licensing issues.

2017-02-19 - 1.2.1 Release

The team is happy to announce that version 1.2.1 has been released!

The CDATA Encoder was modified so that it does not emit intermediate characters between adjacent CDATA sections.
The documentation on gh-pages has been improved.