Why HTML entities exist
In HTML, the characters <, > and & have special meaning, so to show them as text you write entities: <, > and &. Quotes need escaping inside attribute values (" and '). Entities also let you type characters that are awkward to enter, such as © for the copyright sign.
Choose Encode and pick how far to go. Only & < > quotes is the safe minimum for inserting text into HTML. Named entities additionally turns characters such as é, € and © into é, € and ©. Numeric and hex output every non-ASCII character as é or é, which is useful for pure-ASCII email templates and legacy systems.
Choose Decode to reverse it. The decoder understands common named entities and every decimal or hexadecimal numeric reference, including emoji above the Basic Multilingual Plane. Unknown names are left untouched rather than guessed.
Worked example
Input:
<p class="note">Café & crème — €5</p>Encoded with named entities:
<p class="note">Café & crème — €5</p>Pasted into an HTML page, this displays exactly the original markup as visible text instead of rendering a paragraph. Decoding it returns the original string.
Escaping and security
Escaping untrusted text before inserting it into HTML is the core defence against cross-site scripting (XSS). Do it with your framework's built-in escaping, which knows the context, rather than by hand; React, Vue and most template engines escape by default. Remember that HTML text, attribute values, JavaScript strings and URLs each need different escaping, so entity encoding alone does not make text safe in every position. For URLs use percent-encoding, and see Base64 for binary data.
Frequently asked questions
What is the difference between named and numeric entities?
Named entities like é are easier to read; numeric ones like é or é work for every Unicode character, including those without a name. Both display identically in browsers.
Do I need to encode non-ASCII characters at all?
Not in UTF-8 documents served with the correct charset: you can include é or € directly. Entities help only in ASCII-only contexts such as some email systems.
Is encoding enough to prevent XSS?
Not by itself. It protects text inserted as HTML content, but attributes, scripts and URLs have their own rules. Use your framework's escaping and a Content Security Policy.
What happens to an unknown entity such as &foo;?
It is left as it is, because guessing could change your text. Only known named entities and numeric references are decoded.