HTML entity encoder and decoder

Five: & < > " and '. In text content only & and < are strictly required; in an attribute the quote you used matters. Escaping all five is the safe default and is what the minimal mode does — it costs a few bytes and removes a class of bugs.

Named entities (&amp;, &copy;, &hellip;) are readable; numeric ones (&#38;, &#169;, &#8230;) are unambiguous. Numeric forms work for every Unicode codepoint, including emoji, while the named set is a fixed list. Named mode uses a name when one exists and falls back to decimal.

Because the alternative is a tool that looks like it decoded and did not. If &bogus; were left as literal text, the output would be silently wrong; refusing lets you see that the input was not the entity you thought it was.

About 150 — the set forms, CMSes, email templates and documentation actually emit, including the punctuation and Greek letters. The full HTML5 list has 2,231 names; this page says which one it implements rather than implying it knows them all.

Not on its own. Entity-escaping is correct for text and quoted attributes, but a value placed in an unquoted attribute, inside a <code>script</code> block or in a URL is a different context with different rules. Server-side output encoding per context is the control; this page is a convenience, not a security boundary.