FAQ
Why escape angle brackets?
Otherwise the browser parses them as tags. Concatenating raw user input into a page is the classic source of XSS.
What do & and < stand for?
& is an ampersand, < is a less-than sign. Entities start with & and end with a semicolon.
Will escaping change what users see?
No. The browser renders entities back to the original characters; only the source differs.
About this tool
Encoding touches four characters: &, <, > and ". Those are the only ones that must be escaped when placing text into HTML — otherwise the browser reads < as the start of a tag and & as the start of an entity. The order is fixed too: & first, or the entities produced afterwards get escaped again.
Decoding is a single scan: &lt; decodes one level to <, not to <. That matters — a chain of sequential replacements would decode &lt; twice into an angle bracket, silently corrupting the content. Decimal and hexadecimal numeric entities (', ') and ' are handled too.
Two limits worth knowing: single quotes are not escaped on the encoding side (sometimes you need them escaped, for instance in a single-quoted attribute or a JSON string inside onclick — add ' by hand); and named entities go far beyond these four — , ©, — are left as-is because this tool does not carry an entity table.
Remember that escaping only prevents text from being parsed as markup; it is not complete XSS protection. Interpolating user input into attribute values, inline scripts or javascript: links has its own rules. The safe route is letting the DOM (textContent) or a template engine escape for you instead of building strings by hand.