Two directions. Encode turns text into HTML character references: only the five reserved characters (& < > " '), those plus every non-ASCII character, or every character. References can be written by name where one exists (é), in decimal (é) or in hexadecimal (é). Decode turns references back into characters using the full table of 2,125 HTML5 names and the same rules browsers follow. Below the result, the same text is shown as a JavaScript string escape (\u00E9, \u{1F600} or a surrogate pair for old engines) and a CSS escape for the content property (\E9 ).
When you actually need entities
With a UTF-8 page (<meta charset="utf-8">, the default for modern sites), any character can be written directly: é, —, 😀 need no entity. What must always be escaped is markup-significant text:
& as & and < as < in page text, so they are not read as the start of a reference or a tag." as " inside a double-quoted attribute value, and ' as ' inside a single-quoted one.> as > is not strictly required in text but is customary and harmless.
That is what the default "only & < > " '" scope does. Encoding every non-ASCII character is useful when the text will pass through a system that may not keep UTF-8 (some email pipelines and old databases), and , ­ and ‍ remain handy for invisible characters you want to see in the source.
Decoding like a browser
Browsers are forgiving, and the rules are precise:
- The longest matching name wins:
∉ is ∉, while ¬it; (not a name) decodes ¬ and leaves it;. - 106 legacy names from HTML 4, such as
&, <, © and é, also work without the semicolon. Newer ones such as &hellip do not. - In attribute values a legacy name without a semicolon is left alone if it is followed by
= or a letter or digit. That keeps URLs like ?a=1©=2 intact. Choose "Attribute value" to see this. - Numeric references
�, surrogates and values above U+10FFFF become U+FFFD (�), and € to Ÿ become the Windows-1252 characters (– is an en dash), for compatibility with old pages.
Unknown names such as &foo; are left exactly as written and listed, so a typo does not vanish silently. The decoder is checked against an independent implementation of the HTML specification on thousands of generated inputs.
Escaping is not sanitising
Encoding the reserved characters is how you put untrusted text into HTML safely, and it is the core defence against cross-site scripting (XSS): <script> becomes the visible text <script>. But it only protects page text and quoted attribute values. Inside a <script> block, a style attribute, an event handler such as onclick or a URL in href, other rules apply, and HTML-escaping alone is not enough. Your template engine's automatic escaping is the right tool in code; this page is for checking, debugging and one-off content. The article HTML entities vs UTF-8, and when escaping stops XSS covers the cases with examples. For URLs, use the URL encoder; for code points and grapheme clusters, the Unicode and emoji lookup.
