Encode mode escapes the five characters that can change the structure of HTML — & < > " ' — which is precisely the set you must neutralize before interpolating untrusted text into a page. Decode mode reverses numeric references (decimal and hex) plus the common named entities. Character counters on both panes update live.
Why only five characters, and why ' instead of '
Ampersand is replaced first, so pre-existing entities in your input do not get half-mangled, then < > " and the apostrophe. The apostrophe becomes the numeric ' rather than ' because ' was never defined in HTML 4 and some legacy parsers render it literally; the numeric form works everywhere. Everything outside those five passes through untouched: on a UTF-8 page, © and em dashes and accented letters are perfectly legal as raw characters, and converting them to entities adds bytes without adding safety.
Decode is single-pass, and astral code points are a known limit
Decoding runs one combined pass, so double-escaped input unwraps exactly one layer: &lt; becomes <, not <. That is deliberate. It means text escaped twice (common when a CMS escapes content that was already escaped) needs two explicit decode runs, and you can see each layer as you go.
The entity table holds sixteen mappings: the fourteen named entities you actually meet in copied web text — nbsp, copy, reg, trade, mdash, ndash, hellip, laquo, raquo, plus the structural amp, lt, gt, quot, and apos — and two numeric aliases for the apostrophe. Anything unrecognized, like é, is left exactly as-is rather than guessed at. Numeric references are decoded with a 16-bit routine, so code points above U+FFFF come out wrong: 😀 (the grinning-face emoji) decodes to the private-use character U+F600 instead. References below 65536, like ❤ for the heavy black heart, are fine.
One thing people ask
My page is UTF-8. Do I still need to escape user input?
Yes. The charset determines which characters can appear literally; it has nothing to do with injection. A user-supplied <script> tag is valid UTF-8 and will execute if you interpolate it raw. The five structural characters need escaping in element content and attribute values regardless of encoding.
Escaping depends on context: this tool covers HTML element content and attribute values, while a value going into a URL query string needs the URL encoder instead. Using the wrong one for the context is how injection bugs slip through.