HTML entity encoder & decoder — offline

Escaping markup is one of those jobs that is trivial until it is a security incident. Text that will end up inside an HTML page has to have its special characters neutralised, or the browser reads content as structure — which is the entire mechanism behind cross-site scripting. Encoding and decoding here are simple string operations running in your browser, with nothing transmitted anywhere.

Five characters carry structural meaning in HTML and are always encoded: &, <, >, the double quote, and the single quote. Leave < unescaped in user-supplied text and the browser will happily treat what follows as a tag; leave a quote unescaped inside an attribute and an attacker can break out of it and add their own.

The ampersand matters more than people expect, and it has to be encoded first — otherwise you end up double-encoding everything you escape afterwards, which is how < ends up visible on a page.

Optionally you can encode every non-ASCII character as a numeric entity, which guarantees the text survives systems with uncertain or legacy encodings. It is rarely needed on a modern UTF-8 stack, but it is the reliable fallback when output is passing through an older pipeline.

Decoding handles numeric entities in both decimal and hexadecimal form, including emoji, and the common named ones such as &, <, ©, and —. It is the quickest way to read what a scraped page, an RSS feed, or a database column actually says once the escaping is stripped away.

Text that still contains entities after one pass was double-encoded somewhere upstream — usually a value escaped once when stored and again when rendered. Decode a second time to recover the original, then fix the pipeline so it only escapes at the point of output.

One caution: escaping is context-dependent. HTML entity encoding is correct for text in HTML body content and attributes, but it is not the right escaping for a URL, for JavaScript string literals, or for SQL. For URLs use percent-encoding; for binary-safe transport use Base64.