Encode and decode HTML entities to prevent XSS attacks and display special characters properly on web pages.
Eight in total: ampersand, less-than, greater-than, double quote, and single quote, plus the forward slash, backtick, and equals sign. The last three are emitted as numeric hex entities (/, `, =) because they matter in attribute-injection contexts, going beyond the basic five characters needed for display.
Yes, both. Decoding is performed by the browser's own HTML parser, so any entity it understands is restored, whether it is a named form like © and ™, a decimal form like & (ampersand), or a hexadecimal one. Encoding, by contrast, produces the fixed set listed above.
It double-encodes, correctly. The ampersand in & is itself escaped to &, so each pass adds one layer of encoding, and each decode pass removes exactly one layer. This makes the tool predictable when you are preparing text that will be decoded later by another system.
Escaping these characters is the standard defense when inserting untrusted text into HTML, because it neutralizes the characters that build tags and attributes. It is one layer, not a complete strategy: keep validating input server-side and avoid inserting untrusted strings into script contexts or URLs.
It stays in the two textareas on the page. Encoding and decoding run as local JavaScript, nothing is stored, and the Clear button wipes both fields instantly.