Tukuk-OS🔣 HTML Entities
ℹ️ What this tool does & how it works
Two directions, one guarantee: whatever the browser's parser accepts, this page produces, and whatever standard entities exist, it decodes using the browser's own table. Encoding escapes the five characters that break HTML (& < > " and '); the optional mode additionally turns every non-ASCII character into a numeric reference, which is how mail archives and legacy pages survive being copied through tools that mangle UTF-8.
When escaping is the whole security story
Injection bugs in web applications are overwhelmingly one forgotten escape: user text containing <script> that the page pastes straight into HTML. Context decides the rule — element text needs &/</> only, attribute values also need quote escaping (both named and numeric forms work anywhere), and JavaScript inside HTML needs neither of these and its own rules instead. Copying from this page is safe; the encoder emits no whitespace changes and re-encoding already-encoded text only touches the ampersands.