What HTML entities are
Some characters have a special meaning in HTML: < starts a tag, & starts an entity, and quotes end an attribute. To show them as text on a web page you write an entity instead: <, &, ". Escaping also keeps text from being read as markup, which is an important defence against injected scripts. Entities exist for symbols too (© for ©, € for €) and any character can be written by its number, as in © or 🦆.
Encoding options
Only & < > " ' is the minimum for safely putting text inside HTML. Plus named letters also turns accented letters and common symbols into their named entities where one exists. Plus all non-ASCII as numbers makes the output pure ASCII, which survives old systems and email: é becomes é and an emoji becomes one numeric entity. Decode understands named, decimal and hexadecimal entities, and leaves anything that is not a valid entity alone.
Questions
Is it safe to paste untrusted HTML? Yes. The tool only changes characters in text; nothing is parsed or run. Does decoding twice matter? Decoding is done once, so &lt; becomes <. For URL escaping and Base64, see Base64 & URL Encode / Decode.