HTML Entity Encoder & Decoder
Convert characters that have meaning in HTML — <, >, &, and quotes — into their entity equivalents, or decode entities back into readable characters.
The five characters that must be escaped
&→&— must be escaped first, or you double-encode everything else.<→<— otherwise the browser reads a tag.>→>"→"— required inside double-quoted attributes.'→'— required inside single-quoted attributes.
Escaping is how you display code on a page
To show <div> as visible text rather than have the browser create a div, the angle brackets must be entities. This is why every documentation site, blog, and tutorial escapes its code samples — the page you are reading does the same thing. If your code snippets are vanishing from a page or breaking the layout, unescaped markup is nearly always the cause.
Escaping and cross-site scripting
Escaping output is the primary defence against XSS. If a user submits <script>alert(1)</script> as their display name and you render it raw, that script executes for everyone who views the page. Escaped, it renders harmlessly as visible text. The rule is to escape at the point of output, not on input — the same data may go to HTML, JSON, and a database, and each needs different treatment. Note that escaping requirements differ by context: HTML body, attributes, JavaScript, and URLs each have their own rules.
Numeric entities
Entities come in named form (&) and numeric form, either decimal (&) or hexadecimal (&). Only a handful of named entities are universally supported, so numeric references are the safer choice for unusual characters. This decoder handles all three forms, including the numeric references often used to obfuscate malicious markup.