How it works
Five characters have special meaning in HTML: < and > start and end tags, & starts an entity, and the two quote marks delimit attribute values. To show them as text you must write them as entities — <, >, &, " and '. Forgetting this breaks layouts and, when the text comes from users, opens the door to cross-site scripting (XSS).
Encoding these five is enough for any UTF-8 web page. Turn on non-ASCII encoding if the text will travel through a system that mangles accented letters or emoji, such as an old email template or a Latin-1 database; each such character becomes a named entity where a common one exists, or a numeric one like 😀 otherwise.
Decoding understands the common named entities plus every decimal (é) and hexadecimal (é) reference. Unknown entities are left as they are. Everything runs locally in your browser.
Frequently asked questions
Is HTML escaping enough to prevent XSS?
It is the right defence for text placed between tags or inside quoted attributes. It is not enough inside <script> blocks, unquoted attributes, URLs (javascript: links) or CSS — each context needs its own escaping. Prefer a template engine that escapes automatically.
What is the difference between and a normal space?
is a non-breaking space: it looks like a space but prevents a line break at that point and is not collapsed with neighbouring spaces.
Why ' instead of '?
' was not part of HTML 4, so some older parsers and email clients do not understand it. The numeric form works everywhere.