diff --git a/app/src/main/java/eu/faircode/email/HtmlHelper.java b/app/src/main/java/eu/faircode/email/HtmlHelper.java
index c51c03b8bf..f07e6e9fd3 100644
--- a/app/src/main/java/eu/faircode/email/HtmlHelper.java
+++ b/app/src/main/java/eu/faircode/email/HtmlHelper.java
@@ -127,15 +127,22 @@ public class HtmlHelper {
 
     static String autolink(String text) {
         Matcher matcher = pattern.matcher(text);
-        StringBuffer sb = new StringBuffer();
+        StringBuilder sb = new StringBuilder();
+        int end = 0;
         while (matcher.find()) {
-            String ref = matcher.group();
-            matcher.appendReplacement(sb, String.format("<a href=\"%s\">%s</a>", ref, ref));
+            sb.append(html(text.substring(end, matcher.start())));
+            String ref = html(matcher.group());
+            sb.append(String.format("<a href=\"%s\">%s</a>", ref, ref));
+            end = matcher.end();
         }
-        matcher.appendTail(sb);
+        sb.append(text.substring(end));
         return sb.toString();
     }
 
+    private static String html(String plain) {
+        return plain.replace("&", "&amp;").replace("<", "&lt;");
+    }
+
     static Drawable decodeImage(String source, Context context, long id, boolean show) {
         int px = Helper.dp2pixels(context, 48);
 
diff --git a/app/src/test/java/eu/faircode/email/HtmlHelperTest.java b/app/src/test/java/eu/faircode/email/HtmlHelperTest.java
index 4e91540515..9ca5787e46 100644
--- a/app/src/test/java/eu/faircode/email/HtmlHelperTest.java
+++ b/app/src/test/java/eu/faircode/email/HtmlHelperTest.java
@@ -28,10 +28,10 @@ class HtmlHelperTest {
         testAutolink(
                 "https://example.org/search?q=%C3%A4&hl=nl",
 
-                // TODO: Strictly speaking, the & should be encoded as &amp;.
-                // Most browsers can deal with this situation though.
-                "<a href=\"https://example.org/search?q=%C3%A4&hl=nl\">" +
-                        "https://example.org/search?q=%C3%A4&hl=nl</a>"
+                // The & should be encoded as &amp;, even though
+                // most browsers can deal with this situation.
+                "<a href=\"https://example.org/search?q=%C3%A4&amp;hl=nl\">" +
+                        "https://example.org/search?q=%C3%A4&amp;hl=nl</a>"
         );
 
         testAutolink(
@@ -43,8 +43,8 @@ class HtmlHelperTest {
         testAutolink(
                 "Go to <http://example.org/>.",
 
-                // FIXME: The < must be encoded as &lt;.
-                "Go to <<a href=\"http://example.org/\">http://example.org/</a>>."
+                // The < must be encoded as &lt;, to avoid confusion.
+                "Go to &lt;<a href=\"http://example.org/\">http://example.org/</a>>."
         );
 
         testAutolink(