HTML Entity Encoder & Decoder

An entity reference lets a character appear in a document without being read as part of it. Five characters need that treatment because they change how a parser reads the surrounding markup: &, <, >, the double quote and the apostrophe. Everything else is a question of transport, not safety.

Why this does not use the browser to decode

The usual one-line solution assigns the string to innerHTML and reads textContent back. That hands a stranger's input to the HTML parser, which is an XSS sink in any page that does it — the string being decoded is exactly the string you do not trust. Decoding here runs off a table, so nothing is ever parsed as markup.

What that costs, stated plainly

The table holds 198 named references: the five markup characters, the Latin-1 block from HTML 4.01, the common symbol names, and HTML5's upper-case spellings such as &. HTML5 defines 2,231. Every numeric reference decodes regardless — decimal — and hexadecimal — alike — and any name outside the table is listed rather than silently dropped.

Decoded the way a browser decodes text

HTML5 still honours some pre-HTML4 habits, and a decoder that ignores them shows you something other than what a browser renders. The Latin-1 names and &, <, > and " decode without their semicolon, taking the longest name that fits — so &copy2026 is ©2026 and &notit; is ¬it;. Numeric references in the C1 range are read as Windows-1252 (– is an en dash), and a reference to NUL, a surrogate or anything past U+10FFFF becomes U+FFFD, the replacement character. This follows the rules for text content; inside an attribute value a browser is stricter about semicolon-less names.

Unknown names come back unchanged

&bogusentity; is literal text in a document. A decoder that swallowed it would change the content it was asked to reveal, so it is returned exactly as written and reported separately.

Encoding <a href="x"> gives <a href="x">. Note what happens to < on the way back: it decodes to <, not to <. Decoding runs one pass, so a double-encoded string stays visibly double-encoded instead of quietly resolving to markup.