# HTML Entities

> Escape text for HTML, or decode every named and numeric entity.

Category: Encoding · Page: https://util.caruana.me/tools/html/

## API, MCP and A2A

### HTML entities: Encode (`html_encode`)

`GET|POST https://util.caruana.me/api/html/encode` · MCP tool `html_encode` · A2A skill `html_encode` · [reference](https://util.caruana.me/reference/html_encode/)

`minimal` escapes `& < > " '`, which is sufficient inside element content and quoted attributes. `ascii` additionally writes every non-ASCII code point as `&#x…;`.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `input` | string | yes | Text to convert. As a `text/plain` POST body it is used verbatim. |
| `mode` | minimal \| ascii | no | `minimal`: Escapes only & < > " ' — safe for HTML text and attributes. `ascii`: Minimal, plus every non-ASCII character as a numeric entity (&#x…;) |

Privacy: The server receives the `input` text and `mode`, converts it in memory inside the request, and returns the result. Your input is not stored or logged; only the per-call metadata row (operation, time, status, sizes) is recorded. Send secrets in a POST body, not the query string: URLs are recorded in Cloudflare request logs, proxies, and shell history.

### HTML entities: Decode (`html_decode`)

`GET|POST https://util.caruana.me/api/html/decode` · MCP tool `html_decode` · A2A skill `html_decode` · [reference](https://util.caruana.me/reference/html_decode/)

Decodes all 2,231 named entities of the HTML Living Standard plus decimal and hex numeric references, using the HTML parser rules (legacy entities without `;` included).

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `input` | string | yes | Text to convert. As a `text/plain` POST body it is used verbatim. |
| `mode` | minimal \| ascii | no | `minimal`: Escapes only & < > " ' — safe for HTML text and attributes. `ascii`: Minimal, plus every non-ASCII character as a numeric entity (&#x…;) |

Privacy: The server receives the `input` text and `mode`, converts it in memory inside the request, and returns the result. Your input is not stored or logged; only the per-call metadata row (operation, time, status, sizes) is recorded. Send secrets in a POST body, not the query string: URLs are recorded in Cloudflare request logs, proxies, and shell history.


## User guide

The tool sits in a window that works like a desktop app: menus on the top row and the **full-screen** icon at its right (**Esc** leaves full screen). The set-up options described below are in **Settings → Options…**, an overlay, and the **Settings** menu also lists the common choices directly. To keep the options in view instead, choose **View → Inline config**; the page remembers that choice. **Help → Keyboard shortcuts…** lists the keys.

**Encode** turns text into something safe to place inside HTML.

- **Minimal** escapes `&`, `<`, `>`, `"` and `'`. Use it for element content and for attribute values in quotes.
- **All non-ASCII** also writes every character above U+007F as a numeric reference (`é` → `&#xe9;`). Use it when the HTML must survive a system that mangles non-ASCII bytes.

**Decode** turns entities back into characters: named (`&eacute;`), decimal (`&#233;`) and hexadecimal (`&#xE9;`).

> Escaping is context-dependent. These encodings are correct for HTML text and quoted attributes. They are **not** sufficient inside `<script>`, `<style>`, unquoted attributes, or URLs (`href="javascript:…"`). Use the right encoder for each context, and a templating system that escapes by default.

## Specification

| Mode      | Replacements                                                                                                                        |
| --------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| `minimal` | `&`→`&amp;` `<`→`&lt;` `>`→`&gt;` `"`→`&quot;` `'`→`&#39;`                                                                          |
| `ascii`   | `minimal`, then every code point ≥ U+0080 → `&#x<lowercase hex>;` (astral characters become a single reference, not two surrogates) |

- **Decoding.**
  - **Which references.** All 2,231 named character references of the WHATWG HTML Living Standard, plus decimal and hexadecimal numeric references, as the HTML tokenizer handles them in text content. That includes the legacy names that work without a trailing `;` (for example `&amp` and `&copy`).
  - **Code point mapping.** Numeric references to C1 control code points are mapped per the standard's table (`&#128;` → `€`). Invalid code points become U+FFFD.
  - **Ampersands that aren't references** are left unchanged.
- **Single pass.** Decoding runs once, so `&amp;lt;` decodes to `&lt;`, not `<`.
- **Errors.** None: every input produces output.