HTML entity encode and decode

Five characters, three ways to write each one

Only five characters strictly require escaping in HTML: < and > (which open and close tags), & (which starts every entity), and the two quote marks " and '. Everything else — accented letters, the copyright sign, em dashes, emoji — can sit in a UTF-8 document as a literal character and render fine; you only need an entity for it when your file encoding or transport can't carry the raw byte. When you do escape, there are three interchangeable notations: a named reference such as ©, a decimal numeric reference ©, or a hexadecimal one © — all three resolve to the same character (©). Named references are the most readable but only exist for a fixed list; the numeric forms work for any Unicode code point, which is why exporters and templating engines tend to emit them.

Context decides what you escape

The same string is unsafe in different ways depending on where it lands. In element text, the danger is < and & — escape those and a browser can never read your data as markup. Inside an attribute value the quote characters become the threat: an unescaped " closes the attribute early and lets an attacker bolt on onmouseover=… or a new tag. That is why robust escaping for attributes covers " and ' as well. Entities do not protect you everywhere, though — text destined for a <script> block, an inline event handler, or a URL needs JavaScript-string or percent-encoding instead, because the HTML parser never runs on it. Match the encoding to the sink, not the source.

Decoding, double-encoding, and privacy

Decoding here uses the browser's own HTML parser, so it resolves named, decimal and hex references the exact way a real page would. The classic mistake when round-tripping is double-encoding: escape content that was already escaped and & becomes &, so the literal entity text leaks into the rendered page. If you're unsure of an input's current state, decode it once first, confirm it looks right, then encode a single time for the context you're writing into. Both directions run entirely on your device — paste markup from a private export or a database dump freely; nothing is uploaded or stored.