HTML entity encoder
Escape HTML special characters in your browser, with a choice between the minimum HTML requires and full numeric escaping.
Runs in your browser
The first is almost always right. The last inflates CJK text several times over and is only for old pipelines.
Nothing to convert yet.
Five characters matter. The rest is preference
Only five characters change how a browser parses HTML: &, <, >, " and
'. Escaping those is what stops text being read as markup, and it is the
entire security-relevant part of this operation.
Everything else — ©, —, £, Chinese, emoji — is ordinary text in a UTF-8
document and needs no escaping at all. So “only what HTML requires” is the
right setting almost every time, and it is the default.
The other two exist for real but narrow reasons:
- Named entities where they exist produces
©and—, which some people prefer to read in source. - Everything non-ASCII escapes every accented and CJK character numerically. A page of Chinese becomes roughly six times its own length. Use it only for a pipeline that genuinely cannot carry UTF-8 — and be aware that is a much rarer situation than it was.
Order matters, and it is why & goes first
& must be escaped before anything else. If it were escaped last, < would
become < and then that ampersand would be escaped again into &lt;,
which displays as the literal text < rather than a less-than sign.
Escaping is not idempotent, and it is not meant to be. Running it twice deliberately produces different output — which is why you should escape at the point of output, once, rather than storing escaped text in a database.
Decoding takes all three forms
,   and   are the same character written three ways, and
the decoder accepts all of them, plus the uppercase &#X variant that turns up
in older markup.
Anything it does not recognise is left exactly as it was. R&D stays R&D
rather than becoming mangled, because a bare & not followed by a valid entity
is just an ampersand.
Two things are deliberately refused: escapes naming a lone surrogate
(�) and escapes beyond the Unicode range. Neither is a character, and
inventing one would corrupt the output.
This is not sanitisation
Escaping makes text safe to display. It does not make untrusted HTML safe to include — for that you need a sanitiser that understands tags and attributes. If you are pasting user-submitted markup into a page, this is not the tool.
Nothing is uploaded
Everything runs in this page.