HTML Entity Encode & Decode

HTML entities are how you safely include characters in an HTML document that would otherwise be interpreted as markup. If you want to display the literal text <script>alert(1)</script> on a web page — say, in a tutorial about cross-site scripting — you cannot write it directly into the HTML; the browser would try to execute it as a script tag. Instead, you replace the angle brackets, ampersands, and quotes with their entity equivalents: &lt;script&gt;alert(&#39;XSS&#39;)&lt;/script&gt;. The browser renders the entities as the original characters visually, but never interprets them as code. This is one of the most fundamental web security concepts, and it is relevant far beyond security: every template engine, every blogging platform, and every content management system encodes user-submitted text this way before rendering it, to prevent both intentional attacks and accidental page breakage.\n\nThere are three kinds of HTML entities. Named entities use a mnemonic name, like &amp; for &, &lt; for <, &gt; for >, &quot; for a double quote, and &nbsp; for a non-breaking space — there are over 2,000 of these defined in the HTML specification, covering Latin letters with diacritics, Greek letters, mathematical symbols, arrows, and more. Numeric decimal entities use the character's Unicode code point in decimal: &#169; for the copyright sign. Numeric hexadecimal entities use the code point in hex: &#xA9; for the same copyright sign. All three forms are equivalent for characters that have a named entity. The tool uses named entities where they exist (for the five core XML/HTML characters plus commonly used ones) and falls back to numeric hex entities for everything else.\n\nWhy would you need this tool? There are a few common scenarios. You are writing a blog post or documentation that includes HTML code snippets — you need to entity-encode the angle brackets and ampersands so they display correctly in the page instead of being interpreted as HTML. You are working with a legacy system or email template that requires pure ASCII and you need to convert accented characters to their entity equivalents. You received a piece of text that contains HTML entities (&eacute;, &copy;, &rarr;) and you want to see the actual characters they represent. Or you are debugging why some text on your page is not rendering correctly — decoding the entities lets you see the raw string that the browser received before it applied any parsing.