HTML Entities & Character Encoding

An HTML Entity is a character sequence that begins with an ampersand (&) and concludes with a semicolon (;). It is used in web development to display reserved syntax characters (such as < and >), invisible characters (like non-breaking spaces), and symbols outside the standard ASCII character set without conflicting with HTML parser tag tokens.

You can encode raw text to HTML entities or decode entities back to readable text using our free browser-based HTML Entities Encoder & Decoder tool.

---

The 5 Core Reserved HTML Characters

In HTML and XML syntax, five characters are strictly reserved because they define tag boundaries, attributes, and entity declarations. If used raw within text nodes, the browser parser interprets them as structural markup:

Character	Meaning	Named Entity	Decimal Entity	Hexadecimal Entity
<	Less than (Tag start)	&lt;	&#60;	&#x3C;
>	Greater than (Tag end)	&gt;	&#62;	&#x3E;
&	Ampersand (Entity start)	&amp;	&#38;	&#x26;
"	Double quotation mark	&quot;	&#34;	&#x22;
'	Single quote (Apostrophe)	&apos;	&#39;	&#x27;

---

Developer Reference: Frequently Used Entities

Symbol	Description	Named Entity	Decimal Entity	Hex Entity
	Non-breaking space	 	 	 
©	Copyright	©	©	©
®	Registered trademark	®	®	®
™	Trademark symbol	™	™	™
—	Em dash	—	—	—
–	En dash	–	–	–
«	Left-pointing double angle	«	«	«
»	Right-pointing double angle	»	»	»
•	Bullet point	•	•	•
€	Euro currency	€	€	€
£	British Pound	£	£	£
¥	Japanese Yen	¥	¥	¥
←	Left arrow	←	←	←
→	Right arrow	→	→	→

---

Entity Formats: Named vs Decimal vs Hexadecimal

HTML entities can be authored in three interchangeable formats:

1. Named Character Reference (&name;): Human-readable and intuitive (e.g., © for ©). However, HTML5 supports over 2,200 named entities, and older XML parsers or strict XML contexts may only recognize the 5 predefined entities (<, >, &, ", ').
2. Decimal Numeric Character Reference (&#[0-9]+;): References the Unicode code point in base-10 (e.g., © for ©). Universally supported by all browser engines, email clients, and XML/RSS parsers.
3. Hexadecimal Numeric Character Reference (&#x[0-9A-Fa-f]+;): References the Unicode code point in base-16 hexadecimal (e.g., © for ©). Preferred when cross-referencing Unicode charts (such as U+00A9).

---

XSS Prevention & Security Best Practices

Failing to properly encode user-supplied text before rendering it into an HTML document is the primary catalyst for Cross-Site Scripting (XSS) attacks. If an attacker submits <script>alert(document.cookie)</script> and the server renders it unescaped, the browser will execute arbitrary JavaScript within the victim's session.

Context-Dependent Escaping Rules

• HTML Body Context: At minimum, escape &, <, and > to convert malicious tags into harmless text.
• HTML Attribute Context: Inside <input value="..."> or <a title="...">, attributes delimited by quotes must escape " and ' to prevent attribute breakout attacks (" onfocus="evilCode()").
• JavaScript Context: Escaping HTML entities is insufficient inside inline <script> tags. Variables injected into JavaScript must be serialized using strict JSON escaping (JSON.stringify()) rather than HTML entity replacement.

---

Code Examples: Escaping & Unescaping

Fast JavaScript HTML Escaper

// High-performance HTML escaping without DOM overhead
const HTML_ESCAPE_MAP = {
  '&': '&',
  '<': '&lt;',
  '>': '&gt;',
  '"': '&quot;',
  "'": '&#39;',
};

export function escapeHtml(str) {
  return str.replace(/[&<>"']/g, (char) => HTML_ESCAPE_MAP[char]);
}

export function unescapeHtml(htmlStr) {
  const doc = new DOMParser().parseFromString(htmlStr, 'text/html');
  return doc.documentElement.textContent || '';
}

// Example usage:
console.log(escapeHtml('<script>alert("XSS")</script>'));
// Output: &lt;script&gt;alert(&quot;XSS&quot;)&lt;/script&gt;

Python 3 Standard Library

import html

# Escape unsafe HTML characters
raw_input = '<div class="profile">Tom & Jerry</div>'
safe_html = html.escape(raw_input, quote=True)
# Result: '&lt;div class=&quot;profile&quot;&gt;Tom &amp; Jerry&lt;/div&gt;'

# Unescape entities back to standard Unicode characters
original_text = html.unescape('&copy; 2026 DevFlow &mdash; All Rights Reserved')
# Result: '© 2026 DevFlow — All Rights Reserved'

---

Frequently Asked Questions

What is the difference between HTML Entity encoding and URL encoding?

HTML Entity encoding converts characters that break HTML DOM parsing (like < to <), whereas URL Encoding converts characters that break URI query strings and path routing (like spaces to %20 or / to %2F). They operate on different protocols and should not be used interchangeably.

What is   and why is it used?

  stands for Non-Breaking Space. In standard HTML, web browsers collapse multiple sequential whitespace characters into a single space. Using   forces the browser to display multiple contiguous spaces and prevents an automatic line break between two words (such as between numbers and units: 100 km/h).

Does HTML escaping eliminate all XSS vulnerabilities?

No. HTML escaping only neutralizes markup injection within standard HTML body text and attribute values. It does not protect against DOM-based XSS when passing values to eval(), innerHTML, setTimeout(), or javascript: URI schemes. Defense-in-depth requires a strict Content Security Policy (CSP) and modern frameworks (such as React or Next.js) that automatically escape rendered JSX variables.

Can modern UTF-8 websites omit HTML entities?

Yes, for most foreign characters. Because modern web pages use <meta charset="utf-8">, you can directly type characters like ©, €, é, or emojis directly into source files without numeric entities. However, the five reserved syntax characters (<, >, &, ", ') must always be escaped whenever they represent raw content rather than HTML markup. Use our HTML Entities tool to convert files reliably.