HTML Entities
Escape text for safe use in HTML, or decode every named, decimal, and hex entity back to characters.
Where your data goes
| Using this page | Using the API, MCP or A2A | |
|---|---|---|
| Where it runs |
In your browser. Escaping is a JavaScript string replacement; decoding uses the bundled entities library (no DOM parsing, so nothing is rendered or executed). | In a Cloudflare Pages Function at the Cloudflare data centre nearest the caller. |
| What leaves your device | Nothing you enter. After the page and its scripts load, no request
carries your input. The browser enforces this: the page's Content-Security-Policy
sets connect-src 'none' and form-action 'none', which
block fetch, XHR, WebSocket, EventSource, beacons and form posts.
| The server receives the |
| Stored | Nothing leaves the page. No cookies, analytics or third-party scripts; the browser keeps only your View → Inline config choice. | Your inputs and results: never. What is stored is your client record (client ID, a SHA-256 hash of your secret, expiry, and the profile you registered with) and one metadata row per call: operation, time, transport, status, error code, duration, request and response sizes, and country. |
| Logged | Nothing (no requests are made). | Only the per-call metadata above, attributed to your client ID. Never parameters, bodies, results, or credentials. Cloudflare, as the host, also processes request metadata (IP address, full URL including the query string, headers) under its own policies, so put inputs in POST bodies. |
| Access | Open to anyone. | Requires a client ID and secret (how to get one). HTTPS only; TLS terminates at Cloudflare. |
Details and how to verify this yourself: Security & privacy.
User guide
The tool sits in a window that works like a desktop app: menus on the top row and the full-screen icon at its right (Esc leaves full screen). The set-up options described below are in Settings → Options…, an overlay, and the Settings menu also lists the common choices directly. To keep the options in view instead, choose View → Inline config; the page remembers that choice. Help → Keyboard shortcuts… lists the keys.
Encode turns text into something safe to place inside HTML.
- Minimal escapes
&,<,>,"and'. Use it for element content and for attribute values in quotes. - All non-ASCII also writes every character above U+007F as a numeric reference (
é→é). Use it when the HTML must survive a system that mangles non-ASCII bytes.
Decode turns entities back into characters: named (é), decimal (é) and hexadecimal (é).
Escaping is context-dependent. These encodings are correct for HTML text and quoted attributes. They are not sufficient inside
<script>,<style>, unquoted attributes, or URLs (href="javascript:…"). Use the right encoder for each context, and a templating system that escapes by default.
Specification
| Mode | Replacements |
|---|---|
minimal | &→& <→< >→> "→" '→' |
ascii | minimal, then every code point ≥ U+0080 → &#x<lowercase hex>; (astral characters become a single reference, not two surrogates) |
- Decoding.
- Which references. All 2,231 named character references of the WHATWG HTML Living Standard, plus decimal and hexadecimal numeric references, as the HTML tokenizer handles them in text content. That includes the legacy names that work without a trailing
;(for example&and©). - Code point mapping. Numeric references to C1 control code points are mapped per the standard’s table (
€→€). Invalid code points become U+FFFD. - Ampersands that aren’t references are left unchanged.
- Which references. All 2,231 named character references of the WHATWG HTML Living Standard, plus decimal and hexadecimal numeric references, as the HTML tokenizer handles them in text content. That includes the legacy names that work without a trailing
- Single pass. Decoding runs once, so
&lt;decodes to<, not<. - Errors. None: every input produces output.
API & MCP
The same logic is available over HTTP and as MCP tools. Unlike this page, these run on the server: see where your data goes.