HTML character references encode characters that would otherwise be markup, whitespace, or difficult to type. Numeric references identify a Unicode code point in decimal or hexadecimal; named references use identifiers such as lt, amp, and nbsp. This decoder shows the exact source entity and resulting character.
Decoding and rendering are intentionally separate. A string containing <script> is inert text before entity decoding but contains angle brackets afterward. tryb reports that transition and keeps the result in a text-only viewer; it never inserts decoded content as HTML.
The named-reference table is deliberately small and explicit rather than pretending to implement a browser tokenizer. Numeric references are checked for Unicode range and surrogate code points, and a terminating semicolon is required to avoid claiming ordinary ampersand prose.
Edge cases worth knowing
- Markup delimiters
- < and > decode to angle brackets. That is not an exploit by itself, but becomes relevant if another layer later treats the result as HTML.
- Control code points
- Numeric entities can encode newlines, NUL, or other controls. tryb surfaces them because they can affect logs, headers, and parsers while remaining hard to see.
- Unknown names
- An unrecognized named reference remains unchanged and does not make the input a match. This avoids implying coverage of the full browser entity catalogue.
Common mistakes
- Decoding entities and then assigning the result to innerHTML without sanitizing the final value.
- Assuming entity encoding is a universal escaping scheme outside an HTML text context.
- Ignoring numeric entities because they do not resemble familiar named references.
- Treating a decoder as a browser-compatible HTML parser.