HTML Entity Encoder

Convert characters to HTML entities and back. By default only the five characters that actually change how markup parses are escaped — `& < > " '` — because on a UTF-8 page escaping everything else just inflates the file and makes the source unreadable.

Decoding uses the browser's own parser, so every named entity is recognised rather than just the handful a lookup table would cover. Encoding iterates by code point, so an emoji becomes one entity rather than two broken surrogate halves.

Frequently asked questions

Which characters actually need escaping in HTML?

In text content, `&` and `<`. Inside attribute values, also the quote character you're using. `>` and the other quote are escaped by convention for safety rather than necessity. Everything else — accents, emoji, non-Latin scripts — is fine as-is on a UTF-8 page, which is every modern page.

Does escaping HTML prevent XSS?

It's necessary but not sufficient, and the context decides. Escaping those five characters is correct for text content and quoted attributes. It is not enough inside a `<script>` block, in an unquoted attribute, in a URL attribute like href, or inside CSS — each needs its own escaping rules. Use your framework's contextual escaping rather than escaping by hand.

What's the difference between named and numeric entities?

`&amp;` versus `&#38;` — the same character. Named entities are readable; numeric ones work in contexts like XML where only five names are predefined. If your output is consumed as XML rather than HTML, prefer numeric.