What this tool does
HTML entities let you display characters that would otherwise be interpreted as markup. Encoding &, <, >, quotes and non-ASCII characters prevents broken output and injection bugs. Decoding turns &, é and named entities back into readable text. This is a text utility, not a full HTML sanitizer.
How to use it
- Choose encode or decode.
- Pick minimal escaping or all non-ASCII.
- Copy the result or swap it back.
Questions
Is escaping enough to prevent XSS?
Not always. Context matters: HTML text, attributes, URLs and JavaScript need different escaping. Use a reputable sanitizer for rich HTML.
Named vs numeric entities?
Named entities use mnemonics such as & or €; numeric entities use decimal or hex code points. Browsers understand both.
Does it alter emoji?
In all mode, emoji become numeric entities; decoding restores them exactly.