HTML Entity Encoder/Decoder

Escaping exists because a few characters mean something to an HTML parser:

Essential mode does exactly this and leaves everything else alone. It is all you need to show text safely in a page served as UTF-8.

Entities are correct for HTML text and attribute values. They are the wrong tool elsewhere:

• Inside a <script> block, content is not entity-decoded at all, so < would appear literally. Put data there as JSON, with < escaped as \u003c.
• In a URL, special characters are percent-encoded instead: see the URL encoder.
• Escaping does not make untrusted HTML safe to insert. It makes text display as text. Letting a user's HTML through needs a sanitiser, not an encoder.

Named references such as é and © are readable in source. HTML 4 defines 252 of them, which is what this tool knows. Characters without a name are left as they are.

Decimal (é) and hexadecimal (é) references work for every Unicode character, and a single reference covers an emoji that is two UTF-16 code units in JavaScript.

If your page declares UTF-8, which it should, you rarely need any of them beyond the essentials. Reach for numeric references when the text may be saved or transmitted in an encoding you do not control, such as an email template or a file passed through an older system.

Decoding replaces references that end in a semicolon with their characters, in a single pass: < becomes <, not <. Anything unrecognised, and bare ampersands like the one in AT&T, are left as written.

Numeric references between 128 and 159 are read the way browsers read them, as Windows-1252 characters, so – is an en dash. Out-of-range or surrogate values become the replacement character.