Why you escape HTML
Browsers treat certain characters as markup: < starts a tag, & starts an entity, and quotes delimit attributes. To show those characters as literal text — say, a code sample or a stray ampersand in a title — you replace them with HTML entities so the browser prints them instead of interpreting them.
Encoding also helps prevent broken layouts and a class of injection bugs, since user text can no longer be mistaken for tags. Decoding does the reverse, turning entities back into the original characters.
Worked example
The string <b>Tom & Jerry</b> encodes to:
< / >.&.<b>Tom & Jerry</b> — shows as text, not bold.Named vs numeric entities
Named entities like © and & are readable but only exist for specific characters. Numeric entities like © (decimal) or © (hex) work for any Unicode code point, which is why the "all non-ASCII" mode uses numeric form — it's universal. For most web use, escaping just the five essentials is enough.
The five characters that matter (and why)
For inserting untrusted text into ordinary HTML, escaping just five characters is enough to keep it as text rather than markup:
| Character | Entity | Why it's dangerous unescaped |
|---|---|---|
< | < | Starts a tag — lets text open <script> or other elements. |
> | > | Closes a tag; escaping it avoids edge-case parsing surprises. |
& | & | Starts an entity; without escaping, © in user text turns into ©. |
" | " | Ends a double-quoted attribute value, letting text break out of it. |
' | ' | Ends a single-quoted attribute value (use ' — ' isn't valid in HTML 4). |
Escaping depends on context — this is the part that bites people
HTML entity encoding is correct for one place: text and attribute values inside an HTML document. It is not the right escaping everywhere, and using the wrong one is how cross-site scripting (XSS) bugs happen:
- Inside HTML text or an attribute → HTML-entity encode (what this tool does). ✅
- Inside a
<script>block or a JS string → you need JavaScript string escaping, not HTML entities.<inside a script is just the literal characters, not a<. - Inside a URL or query parameter → use percent-encoding via the URL encoder, not HTML entities.
- Inside a CSS value or an
on*event handler → these have their own escaping rules and are best avoided for untrusted data entirely.