HE(1)

💖 he(1) — encode/decode HTML entities just like a browser would 💖

okay bestie, pull up a chair, because this little utility is about to become your new hyperfixation. it's called he, it's a manual page situation (manual name is he, section 1, iykyk), and it does exactly one thing but does it flawlessly: it encodes and decodes HTML entities in strings just like a browser would. no cap.

---

✨ SYNOPSIS ✨

he [--escape string]
   [--encode string]
   [--encode --use-named-refs --everything --allow-unsafe string]
   [--decode string]
   [--decode --attribute string]
   [--decode --strict string]
   [-v | --version]
   [-h | --help]

---

🌸 DESCRIPTION 🌸

he encodes/decodes HTML entities in strings just like a browser would. that's it. that's the whole vibe. it's giving "small tool, main character energy."

---

💅 OPTIONS 💅

• --escape — hand it a string of text and it escapes it for use in text contexts in XML or HTML documents. only these characters get escaped, bestie: &, <, >, ", and '. the iconic five. 🫶
• --encode — give it a string and it encodes any symbols that aren't printable ASCII symbols and that can be replaced with character references. for example, it would turn © into ©, but it would not turn + into +, because like… why would it, there's literally no point. 💀 additionally, it replaces any remaining non-ASCII symbols with a hexadecimal escape sequence (e.g. 𝌆). the return value of this function is always valid HTML. always. periodt.
• --encode --use-named-refs — turns on the use of named character references (like ©) in the output. ⚠️ if compatibility with older browsers is a concern for you, don't use this option. like, genuinely, don't.
• --encode --everything — encodes every symbol in the input string, even the safe printable ASCII ones. go big or go home. 🔥
• --encode --allow-unsafe — encodes non-ASCII characters only. this leaves unsafe HTML/XML symbols like &, <, >, ", and ' completely intact. yes, really, they just sit there. 🙈
• --encode --decimal — uses decimal digits rather than hexadecimal digits for encoded character references. so you get © instead of ©. same energy, different base. ✨
• --decode — takes a string of HTML and decodes any named and numerical character references in it, using the algorithm described in the HTML spec. the actual spec. we don't freestyle here. 💜
• --decode --attribute — parses the input as if it was an HTML attribute value rather than a string in HTML text content. context matters, bestie. 🎀
• --decode --strict — throws an error if an invalid character reference is encountered. it's the friend who will absolutely tell you when something's wrong. 😭
• -v, --version — prints he's version. cute little status check. 🌈
• -h, --help — shows the help screen. your lil map. 🗺️

---

⭐ EXIT STATUS ⭐

the he utility exits with one of these values, and yes we're listing them all:

1. 0 — he did what it was instructed to do successfully; either it encoded/decoded the input and printed the result, or it printed the version or usage message. slay.
2. 1 — he encountered an error. not slay. 😭

---

🦋 EXAMPLES 🦋

he --escape '<script>alert(1)</script>'

prints an escaped version of the given string that's safe for use in HTML text contexts, escaping only &, <, >, ", and '. bye bye script injection, hello safety. 🛡️

he --decode '©𝌆'

prints the decoded version of the given HTML string. watch those entities turn back into real characters. ✨

echo '©𝌆' | he --decode

prints the decoded version of the HTML string that gets piped in. pipe girlies, this one's for you. 🫶

---

💀 BUGS 💀

he's bug tracker is located at <https://github.com/mathiasbynens/he/issues>. go file your feelings there, it's the responsible thing to do. 🐛

---

👑 AUTHOR 👑

Mathias Bynens <https://mathiasbynens.be/> — the icon, the legend, the person who made this whole thing happen.

---

🌈 WWW 🌈

<https://mths.be/he>

---

and that's the whole page, bestie. April 5, 2016, source he(1) — from the he manual, section 1. love that for us. mwah. 💋✨🎀