HTML Entity Encoder & Decoder

Why entities exist

HTML reserves a handful of characters for its own syntax. < opens a tag and & opens an entity reference, so a document that wants to display those characters needs another way to write them. Entities are that escape hatch: < renders as < without the parser treating it as markup.

Two forms exist. Named references like & and © are readable; numeric references like & and © (or hex ©) work for any Unicode code point.

The characters that matter

Character	Entity	Why it needs escaping
&	&	Starts an entity reference
<	&lt;	Starts a tag
>	&gt;	Symmetry; closes a tag
"	&quot;	Terminates a double-quoted attribute
'	&#39;	Terminates a single-quoted attribute

Strictly, text content only needs & and < escaped. Attribute values additionally need whichever quote character encloses them. Escaping all five is the safe default and costs nothing.

Order matters when escaping by hand: & must be replaced first, or the ampersands you introduce for the other four get escaped a second time and < ends up as <.

Escaping non-ASCII

The third mode also converts every character above U+007F to a numeric reference. That was essential when documents were served as ASCII or Latin-1 with unreliable charset headers.

With <meta charset="utf-8"> — which you should have — it’s no longer necessary, and readable UTF-8 is smaller and easier to work with. It remains useful for legacy systems, email templates, and any pipeline that mangles bytes above 127.

Escaping is not the whole XSS story

Entity encoding is a necessary defence, but it is context-dependent, and applying the HTML rules everywhere gives false confidence. The same value needs different treatment in different places:

• Text content — HTML entity encoding, as here.
• Attribute values — entity encoding, and always quote the attribute.
• URLs — percent-encoding, plus a scheme allowlist to block javascript:.
• Inside <script> — JavaScript string escaping; entities are not interpreted there.
• Inside <style> — CSS escaping.

In practice, let your templating engine handle this. React, Vue, Svelte and every modern server framework escape by default and know which context they’re in. Reach for manual escaping only when you’re building markup as a string, which is itself a signal to reconsider the approach.

  and pasted content

A non-breaking space renders like a normal space but forbids a line break at that point. Word processors and rich-text editors insert them constantly, so text pasted from those sources often arrives full of  . Decoding here converts them to ordinary spaces — usually what you want before storing or reformatting content.