HTML entities are special character sequences that represent reserved or invisible characters in HTML, using named references (like &) or numeric codes (like &). They ensure that characters with special meaning in HTML syntax are displayed correctly in the browser.
Why entities exist
HTML uses <, >, &, and " as part of its syntax. If you want to display a literal < character on a page without the browser interpreting it as a tag, you need to encode it as <. Without entities, <script> in your content would be parsed as an actual script tag.
The five essential entities every developer should know:
| Character | Entity | Numeric |
|---|---|---|
< | < | < |
> | > | > |
& | & | & |
" | " | " |
' | ' | ' |
Named vs. numeric entities
Named entities are readable (© for ©, — for —) but limited to a predefined set. Numeric entities can represent any Unicode code point: 😀 renders as the grinning face emoji. The &#x prefix indicates hexadecimal; &# without the x uses decimal.
<!-- Named -->
<p>© 2026 — All rights reserved</p>
<!-- Numeric (hex) -->
<p>© 2026 — All rights reserved</p>When to use entities
- Always encode
<,>,&in text content and attribute values to prevent XSS vulnerabilities and parsing errors - In attributes: Double quotes inside
hrefortitleattributes need" - Special characters: Non-breaking spaces (
), em dashes (—), arrows, math symbols - Legacy encoding: When your document encoding doesn’t support certain characters
Modern HTML5 with UTF-8 encoding means you can type most characters (©, é, —) directly. Entities are mainly needed for the five reserved characters and for characters that are hard to type or invisible.
Security implications
Failing to encode user input as HTML entities is the root cause of cross-site scripting (XSS) attacks. If user-supplied text containing <script>alert('xss')</script> is inserted into a page without encoding, the browser executes it. Always encode output — every template engine does this by default for good reason.
Encode and decode HTML entities with the HTML Encoder/Decoder or browse the full list with the HTML Entities Reference.