HTML entity encoder

What is covered

Escaping replaces the five characters that can change the meaning of markup: & < > " '. That is enough for text content and for a quoted attribute value, and it is deliberately no more than that — escaping everything makes output nobody can read. The + non-ASCII mode additionally rewrites every character outside printable ASCII as a hex numeric reference, for transports that mangle UTF-8; newlines and tabs are left as they are.

Unescaping runs the browser's own HTML parser, so all ~2,200 named references the HTML standard defines are understood —  , &, é, — and the long tail nobody memorises — along with decimal (') and hex (') references, including the semicolon-less forms HTML tolerates. No table is shipped, so there is nothing here to be out of date. Parsing happens in a detached document that runs no script and loads nothing.

Two things worth knowing about the result:   decodes to U+00A0, which looks exactly like a space but is not one, and escaping is not a sanitiser — inside <script>, <style>, a URL, or an unquoted attribute, HTML escaping does not make untrusted input safe.