What is an HTML Entity Encoder / Decoder?
Showing HTML as text: in docs, comments, code examples, requires escaping the five special characters, or the browser interprets them as markup. Unescaped user input is also the root of XSS.
Encode turns < > & " ' into entities; decode reverses any named or numeric entity back to plain text.
Frequently asked questions
Which characters get encoded?
The five that break HTML: & < > " and '. That is sufficient for safe text embedding.
Does decode handle numeric entities?
Yes: named (&), decimal (&) and hex (&) all decode.
Is encoding enough to prevent XSS?
For text content, yes. Attribute, URL and script contexts each need their own escaping: context matters.
Is anything uploaded?
No: both directions run locally.