HTML Entity Encoder and Decoder

What is HTML entity encoding?

HTML character references stand in for characters that markup would otherwise treat as syntax. Named forms look like &. Decimal numeric forms look like &. Hexadecimal numeric forms look like &.

• Operation: Encode or Decode. Encode is the default.
• Input text: ordinary text to encode, or text that already contains character references to decode.
• Entity form for encoding: named entities (the default), decimal numeric entities, or hexadecimal numeric entities. Decode ignores this control.
• Encode all supported characters: off by default, which encodes HTML-special characters only. Turn it on to encode every character the named table supports. Decode ignores this control.

Why HTML entities are used so much

Angle brackets, ampersands, and quotes are not just characters in HTML. They open tags, start entities, and delimit attributes. Paste them in as-is and the parser stops treating them as text.

A common shortcut is to replace only & and < by hand and hope that is enough. Attribute context also cares about quotes, and some documents still contain numeric references that a named-only escape will not round-trip. Miss one of those cases and a heading becomes a broken tag.

Are there alternatives?

URL Encoder and Decoder percent-encodes for query strings and path segments. That is a different grammar. Do not URL-encode HTML and expect a browser to treat the result as markup.

Base64 Encoder and Decoder hides bytes so they can travel through text. It does not produce entities a browser will render as characters.

A context-aware HTML escaper in your own code is the right tool when the input is untrusted and will be injected into a page. This page is a converter. It is not a sanitizer and it is not a complete defense against cross-site scripting.

Fun facts and more info

Named references come from the HTML living standard's named character table, which is much larger than the old HTML4 handful of &, <, >, ", and  . Numeric references can name any Unicode code point the page encoding can represent.

Decoding is forgiving about a mix of named and numeric forms in one string. Encoding always emits one chosen form.

The output is for documents, emails, and debugging pasted markup. Do not treat a successful encode as proof that the result is safe to splice into a website.