What the Encoder Changes
The encoder on this page escapes the five characters that most often need special treatment in HTML text and attributes:
| Character | Encoded form |
|---|---|
& |
& |
< |
< |
> |
> |
" |
" |
' |
' |
For example, <strong>Tom & Jerry</strong> becomes <strong>Tom & Jerry</strong>, so the markup can be displayed as text instead of being interpreted as HTML.
Decoding Named and Numeric Entities
Decode mode uses the browser’s HTML parser, so common named entities and numeric references can be converted back to characters. Examples include &, ', and '.
Entity decoding is not the same as sanitizing untrusted HTML. If decoded text is later inserted into a page as HTML, it can become markup again. Use an appropriate HTML sanitizer or framework escaping rules when the source is untrusted.
HTML Entities vs URL Encoding
HTML entities protect or represent characters in HTML syntax. Percent encoding such as %20 represents bytes in URLs and query strings. Base64 is a different binary-to-text encoding again. Use the URL encoder for URLs and the Base64 encoder for Base64 data.