🔒 Runs entirely in your browser.

Using an AI agent or a script? Call this tool as an API

AI agents and scripts can call this tool directly, to check their work or look something up, and get JSON back with the same answer this page gives. No key needed.

GET https://digitalgreenhouse.com.au/api/tools/html-entity?text=%3Ca%20href%3D%22x%22%3ETom%20%26%20Jerry%3C%2Fa%3E
  • text — string, required. Text to encode, or HTML with entities to decode.
  • mode — string, one of encode | decode, default encode. encode or decode.
  • all — boolean, default false. When encoding, also turn non-ASCII characters into numeric entities.

The API answers from our server, and our code doesn’t store what you send. Fair-use limits apply. API guide · all endpoints (JSON) · OpenAPI

When to escape HTML

A few characters have special meaning in HTML: < and > start and end tags, & begins an entity, and quotes delimit attributes. If you want to show those characters as text — in a code example, or any time you’re inserting untrusted content — you have to “escape” them into entities like &lt;. Doing this properly is also a core defence against cross-site scripting (XSS). Decoding does the reverse, turning entities back into the original characters.

Named or numeric entities?
For the core five (& < > " ') named entities are clearest. For everything else, numeric entities (&#NNN;) always work — tick “Encode all non-ASCII” to force them.
Is escaping enough to stop XSS?
Context matters — HTML, attributes and JavaScript each need the right escaping. Getting this right across an app is exactly the kind of review we do.

AI workshops for teams

Get your team confident with AI.

Interactive half-day and full-day workshops in Copilot, Claude or ChatGPT, run at your office - in Sydney, or anywhere we can fly to.