HTML Entity Encoder and Decoder

An entity is a way of writing a character that would otherwise be read as markup. < puts a literal < on the page instead of starting a tag. There are three forms: named (&), decimal (&) and hexadecimal (&), and they mean exactly the same thing.

Only five characters genuinely need escaping in modern HTML: &, <, >, and both kinds of quote inside attribute values. Everything else — Arabic, accents, emoji, dashes — is served perfectly well as UTF-8, and escaping it makes the file larger and much harder to edit.

Order matters, and getting it wrong is the classic bug. The ampersand has to be escaped first. Do < first and the & in the < you just produced gets escaped in the second pass, giving < — which displays on the page as the literal text <. That is what has happened whenever you see raw entity codes in a heading on a live site.

Decoding accepts all three forms and leaves anything it does not recognise exactly as it was, rather than silently dropping it. A stray & in prose is not a broken entity and should not be touched.

The case this is really for: showing code on a page. You want a visitor to read <a href="?a=1&b=2"> rather than have the browser render a link. Paste it, encode with the minimal setting, and put the result inside your <pre>. Every documentation site does this, and doing it by hand is where the missing escape gets in.

The security note, stated precisely. Escaping is what stops user input from becoming markup — a comment containing <script> is inert once escaped. But this is not an XSS defence you can rely on by pasting text through a web page. Escape at the point of output, in your template engine, automatically, for every value. A manual pass through any tool covers the one string you remembered.

Attribute values need their quotes escaped too. title="5" wide" ends at the second quote, and the rest becomes stray attributes. This is the mechanism behind a meta description that mysteriously stops at an apostrophe — the meta tag generator escapes automatically for that reason.

When to use the numeric setting. Almost never — but if a file may be served without a charset declaration, or is going into a system that mangles anything above ASCII, escaping every non-ASCII character numerically survives it. Load the decode sample: مرحبا is مرحبا, five Arabic letters written as five decimal code points.

If what you are escaping is a URL rather than markup, the URL encoder is the right tool — percent encoding and entities are not interchangeable.