Basic HTML escape mode replaces five syntax-sensitive characters with HTML-safe references: ampersand becomes &, less-than becomes <, greater-than becomes >, double quote becomes ", and apostrophe becomes '. Those five mappings are the core of an HTML escape cheat sheet because the tool protects the characters that can begin, terminate, quote, or otherwise participate in HTML syntax. Ordinary ASCII letters, numbers, spaces, tabs, and line breaks remain readable, so encoding does not turn the entire input into a long stream of entity names. For text such as A & B < C, the useful result is A & B < C: ampersand is handled first, which prevents the generated ampersands from being encoded again. The HTML Entity Encoder / Decoder can produce that result in its basic encode mode. It also offers a non-ASCII mode for workflows that require every code point above ASCII 126 to appear as an uppercase hexadecimal numeric reference; in that mode, an emoji such as 😀 becomes one 😀 reference rather than two surrogate references. Decode mode travels the other way, using the browser’s current HTML parser to resolve current named references and decimal or hexadecimal numeric references. Treat either output as plain text. Escaping protects syntax characters in a string, but it does not sanitize a document or make every programming and web context safe.
Reserved characters in basic mode
This quick reference covers the five characters handled by basic encoding. It is intentionally focused: these are fixed HTML-safe outputs, not a catalog of every named entity supported during decoding.
| Character | Basic output | Role in HTML syntax |
|---|---|---|
| Ampersand: & | & | Begins a character reference, so it must be protected before any generated reference is interpreted again. |
| Less-than: < | < | Begins an HTML tag or can appear in markup-looking text. |
| Greater-than: > | > | Participates in tag syntax and is protected alongside less-than. |
| Double quote: " | " | Often delimits an HTML attribute value. |
| Apostrophe: ' | ' | Can delimit a single-quoted HTML attribute value. |
The order matters. Encoding ampersand first means a source ampersand becomes the start of the safe output, but that newly created ampersand is not processed a second time. Double quotes and apostrophes are both protected because the receiving attribute may use either quote style. Escaping them does not remove the need for a context-correct HTML serializer, and protecting greater-than is still useful when the final destination is plain text. For an expandable explanation of references, see MDN’s character reference glossary.
Encoding and decoding modes
Choose the mode that matches the desired result. Basic encoding is the readable default for modern HTML. Non-ASCII encoding adds numeric representation, while decoding handles a much broader set of references.
| Mode | Direction | Output behavior | Best fit |
|---|---|---|---|
| Basic encoding | Literal characters to HTML references | Replaces the five reserved characters and leaves ordinary readable text largely intact. | General HTML text escaping when a clear, compact result is preferred. |
| Non-ASCII encoding | Literal characters to HTML references | Applies the same syntax protection and converts every code point above 126 to an uppercase hexadecimal reference. | Legacy transport, teaching examples, or workflows that specifically require numeric references. |
| Decoding | HTML references to Unicode text | Uses the active browser parser to resolve current named, decimal, and hexadecimal references. | Inspecting or restoring text that contains existing references. |
Basic mode does not name every printable character, and it leaves non-ASCII characters such as copyright symbols and emoji in readable form. Modern UTF-8 HTML can contain Unicode directly, and MDN recommends avoiding unnecessary references. Non-ASCII mode is therefore an explicit formatting choice, not a requirement for ordinary HTML. Decode mode is also broader than the basic encode table: it can resolve the browser’s current full named-reference set, including legacy aliases and references that produce more than one code point. It is not an exact inverse of the small basic encoding table.
Encode or decode HTML text with the tool
- Choose the operation and mode. Select Encode characters or Decode references. When encoding, select the applicable mode. Use basic mode for the most readable result, or select non-ASCII mode when uppercase hexadecimal numeric references are genuinely required. The available named and numeric decoding behavior comes from the active browser parser, so no separate reference table needs to be selected.
- Paste the source and run the conversion. Paste a small, representative sample into the input field and select the conversion button. Test the sample before processing the full block, especially when it contains ampersands, angle brackets, quotes, or supplementary Unicode characters. The input is limited to 500,000 JavaScript characters. Conversion happens entirely in the browser without uploading the text, saving history, fetching a remote reference table, or transmitting the input.
- Inspect the output and confirm its destination. Check that ampersands, angle brackets, quotes, and apostrophes have the intended references. If non-ASCII mode was selected, confirm that code points above ASCII 126 use uppercase hexadecimal notation and that an emoji is represented by one complete reference. Decoded results appear as plain text in a read-only text area. Copy the result only after confirming that the receiving context uses HTML-aware escaping at its final output boundary.
What decode mode resolves
The decoder uses a detached textarea to ask the browser’s HTML parser to interpret the source. This gives decode mode access to the parser’s current named references and its handling of decimal and hexadecimal numeric references. The returned value is not inserted into the visible page as markup and is not executed. It remains plain text even when the decoded characters resemble an HTML element.
For example, the source <script> can become the literal character sequence <script>. The string shown by the tool is not active markup, but copying it into an unsafe innerHTML sink could create a vulnerability. Treat decoded output as untrusted data. The WHATWG HTML Living Standard’s named character references defines the current table, including legacy aliases and references mapped to multiple code points. The browser may preserve or normalize some legacy parsing details according to the HTML standard it implements. If a downstream system uses XML, remember that XML has a smaller predefined entity set and different parsing rules.
Match escaping to the receiving context
HTML escaping applies to text at the final HTML output boundary. The same string may need entirely different treatment in another language or protocol.
- HTML text node: Basic or non-ASCII encoding can protect the tool’s five syntax characters before the value is inserted as text. In an application, framework auto-escaping or a trusted templating engine is normally the safer automated boundary.
- HTML attribute: Confirm how the attribute value is serialized, including its quote style and any framework rules. The tool’s fixed quote and apostrophe mappings do not make arbitrary attribute construction safe.
- URL or query value: Use URL-specific percent encoding rather than treating HTML entities as URL encoding. HTML references do not replace the rules for valid URL components.
- JavaScript, CSS, SQL, or an HTTP header: Use the escaping system required by that destination. HTML entity output is not a substitute for context-aware encoding, prepared statements, or a trusted protocol stack.
- XML document: Follow XML parsing rules and its smaller entity set instead of assuming that every current HTML named reference is predefined XML.
- Untrusted HTML input: Encoding a string does not sanitize a document or accept rich markup safely. A sanitizer or a strict allowlist is a separate requirement, and a Content Security Policy is not a replacement for output-boundary escaping.
Decoded text can also contain markup-looking content, so do not move it directly into a markup-capable sink. Select the escaping or validation mechanism based on the data and the exact place where that data will be interpreted.
Preflight before copying output
- State the intended result. Decide whether the destination needs encoded HTML references or decoded Unicode text.
- Select the narrowest mode. Prefer basic encoding for readable HTML. Select non-ASCII encoding only when a numeric representation is required by the receiving workflow.
- Verify a representative sample. Confirm that ampersand is protected first and inspect less-than, greater-than, quotes, and apostrophes around the relevant boundaries.
- Check Unicode behavior when needed. In non-ASCII mode, an emoji such as 😀 should become one 😀 reference. In decode mode, a current named reference such as © should resolve to ©.
- Check size and destination. Keep the input within 500,000 JavaScript characters, inspect the final result, and copy it only into an appropriate context-aware workflow.
This cheat sheet supplies the basic mappings and the decisions needed to use them correctly. The HTML Entity Encoder / Decoder handles literal-to-reference conversion, optional non-ASCII numeric output, and browser-based reference decoding without transmitting the source.