HTML Entities

To show text literally in HTML, such as a code sample, a user comment, or a string containing <, five characters must be escaped: & becomes &, < becomes <, > becomes >, " becomes ", and ' becomes '. The ampersand is replaced first so existing text is never double-escaped by the tool itself.

Everything else, including accented letters and emoji, is left as is. Modern pages are served as UTF-8 and display those characters directly, so converting them to entities only makes the source harder to read. The result is safe both between tags and inside quoted attribute values.

Decoding uses your browser's own HTML parser, so it understands every entity the browser does: all named entities such as  , é, and —, decimal references like —, and hex references like —. This is the quickest way to clean text scraped from web pages or exported from a CMS, where & and ' often end up in CSV cells.

A non-breaking space decodes to the U+00A0 character, which looks like a space but does not match a normal space in searches or comparisons. If matching fails after decoding, replace it with a regular space in Find & Replace.

Escaping is the right defense when inserting text into HTML, but it is not a sanitizer for HTML you intend to render. To show user-written Markdown or HTML safely, sanitize the generated markup, as the Markdown Preview does with DOMPurify. For text going into URLs, use URL encoding instead.