HTML Entity Encoder & Decoder

A character reference is a way to write a character with ASCII only. Numeric references work for any Unicode code point, in decimal (é) or hexadecimal (é). Named references are easier to remember: HTML 4 defined 252 of them, covering Latin-1 letters such as é, Greek letters, mathematical symbols and typographic marks like — and …. Curiously ' was not among them; it came from XML and only became valid HTML with HTML5.

HTML5 expanded the list to 2,231 named character references, absorbing the MathML entity set, so names like ✓, ★ and ≂̸ now work in every current browser. The count includes legacy spellings without the closing semicolon, such as &amp and &copy, which parsers still accept for compatibility but which you should not write. The encoder here produces the widely supported HTML 4 names plus ' and falls back to a numeric reference for everything else; the decoder hands text to the browser's own parser, so it understands every one of the 2,231 names.

Only & < > " ' is the setting for everyday work: it escapes the five characters that can end a text node or a quoted attribute, which is enough to show a code sample on a page or place user text safely inside HTML. Also every non-ASCII character turns é, € and emoji into references too, for the rare channel that cannot carry UTF-8, such as some legacy email templates or systems that mangle encodings. Named, Decimal and Hex only change how a reference is spelled; all three decode to the same character. A page saved as UTF-8 needs no entities for accented letters.

Escaping protects the HTML context and nothing else. Text inserted into a script block, an inline event handler such as onclick, a style attribute or an href that might start with javascript: needs different handling, and entity encoding alone does not prevent cross-site scripting there. Frameworks such as React escape text by default, so double-escaping is the more common bug in modern apps: users see & where an ampersand should be. To strip tags entirely, convert the markup with HTML to TXT; for escaping inside URLs, use URL Encode & Decode.