flashman
← All guides

Encode HTML entities with one textarea pass

Encode and decode HTML entities with the textarea the page uses: quotes stay literal, one pass is not two, and a tag in the decode box is not an element.

2026-10-22 · 8 min read

  • html
  • entities
  • tooling

The HTML entities page has two modes and one textarea element behind both. Encode assigns the box to textContent and reads innerHTML. Decode assigns the box to innerHTML and reads value. An empty string returns an empty string without touching the element. Any other string is used as-is, including a single space, a newline, or the character 0.

The sample in the box, <div>flashman & friends</div>, encodes to &lt;div&gt;flashman &amp; friends&lt;/div&gt;. Decoding that string returns the sample. Decoding something that was encoded twice does not.

Encode the characters textarea innerHTML escapes

& becomes &amp;. < becomes &lt;. > becomes &gt;. A double quote is unchanged. An apostrophe is unchanged. é is unchanged. 🙂 is unchanged. A newline stays a newline rather than &#10;. A tab stays a tab. A no-break space becomes &nbsp;. Spaces around a tag stay spaces: two spaces, <tag>, and two spaces encode with the spaces still there and the tag escaped.

a&amp;b encodes to a&amp;amp;b. That is a second level, not a stable form. If you paste an already escaped fragment, decode it first or accept the longer string.

  • Leave quotes to a later attribute encoder.
  • Expect > to be escaped.
  • Expect a no-break space to show up as nbsp.
  • Do not encode a string that is already encoded.

Decode the name the HTML parser stored

&amp; and &AMP; both become &. &lt; becomes <. &Lt; becomes ≪, U+226A, which is a different character with a different name. &gt; becomes >, and so does &gt without a semicolon. &lt;div&gt without a semicolon on gt still becomes <div>. &unknown; is unchanged. foo&bar; is unchanged, because bar is not a character reference.

&#39;, &apos;, and &quot; become the quotes that encode will not produce. &#10; becomes a newline. &#13; also becomes a newline, because the textarea value normalizes a carriage return. &#00062; becomes >. &#128512; becomes 😀. &#x1F642; becomes 🙂. &#x0; and a value past the Unicode range become the replacement character. &copy; becomes ©. &hellip; becomes ….

Treat a tag in the decode box as characters

Setting innerHTML of a textarea does not build child elements from the box. <b>bold</b> decodes to the same characters. </textarea><b>x</b> decodes to the same characters. A fully escaped script tag decodes to the text of a script tag and does not execute. This page is the wrong tool if you wanted a sanitizer. The Markdown preview is the path that removes a script element.

One decode of &amp;amp; is &amp;. A second decode is &. Stop when the text matches the original, and diff the two strings if it does not. The usual leftovers are a no-break space, a doubled amp, or ≪ where a less-than was intended.

Record which mode produced the paste

Copy the output, switch mode, and paste it back only when you mean to reverse that one pass. For a document, use the Markdown editor and copy HTML, which is sanitized and already escaped where marked escaped it. For a real XML document, use the XML tool. Its serializer writes &gt; into text and does not use this textarea.

Use the HTML entities tool for the pass, the Markdown editor for a rendered document, the XML tool for markup, and diff for the round trip. Write down the mode next to the string you save.

Try these tools