HTML Entities, Explained

After reading this you will know exactly which characters you must escape in HTML, how named, decimal and hex entities relate to each other, and how to pick the right form without breaking your markup.

An HTML entity is a way to write a character using only plain ASCII text. Instead of typing the character itself, you type a short code that the browser expands. The classic case is the ampersand. If you write Tom & Jerry in your source, the browser shows Tom & Jerry on screen, but the source contains Tom & Jerry. The five characters & stand in for one visible &.

You reach for entities for two reasons: to escape characters that would otherwise be parsed as markup, and to insert characters you cannot easily type, such as an em dash, a non-breaking space, or the multiplication sign. The reference table on the tool page lists each character with its named form, its decimal form and its hex form, so you can copy whichever one fits.

The three forms of an entity

Every entity you can write falls into one of three syntaxes. They all start with & and end with ;.

Named entity

A memorable keyword between the ampersand and semicolon, for example &,  , ©. Names come from a fixed list maintained in the HTML specification. There are roughly 2,231 named references defined.

Decimal numeric reference

An ampersand, a hash, the Unicode code point in base 10, then a semicolon: & for the ampersand (code point 38), — for the em dash (code point 8212).

Hexadecimal numeric reference

The same as decimal but with an x after the hash and the code point in base 16: & for the ampersand, — for the em dash.

The two numeric forms describe the same code point in different bases, so they always produce the same character. The named form is a lookup: & is defined to mean code point 38, which is exactly what & and & also produce.

Which characters you actually have to escape

This is the part most people get wrong by escaping too much. When your document is served as UTF-8, you can put almost any character directly in the text. You do not need é to write é; the literal é works. Entities are only mandatory for characters that would confuse the parser.

In ordinary text content, two characters are unsafe: & and <. The ampersand starts an entity, and the less-than sign starts a tag. Inside a double-quoted attribute value you must also escape ", and inside a single-quoted attribute value you must escape '. The greater-than sign is safe in practice but is conventionally escaped as > for symmetry.

Note one asymmetry: ' is defined in HTML5 and in XML, but it was not defined in HTML 4. If you must support very old parsers, use the numeric ', which has always worked.

How a code point becomes hex

Converting a Unicode code point to its hex reference is a base conversion. Take the em dash, code point 8212 in decimal. To write it in base 16, divide repeatedly by 16 and read the remainders from bottom to top.

Here each coefficient is a hex digit. Reading them in order gives 2, 0, 1, 4, so the hex string is 2014 and the reference is —. The digits 10 through 15 are written A through F. The term 16^3 equals 4096, so 2 \times 4096 = 8192, and adding 16 + 4 returns 8212. That check confirms the conversion.

Reading the reference table

Each row in the tool gives you four things to copy: the literal character, the named form, the decimal form and the hex form. Pick by context.

• Writing hand-authored HTML in a UTF-8 file: copy the literal character when it is safe, or the named form when you want readable source.
• Generating markup in a language without a full entity table: use the numeric form, since any code point works without a lookup list.
• Targeting XML or strict XHTML: only five named entities exist there (&, <, >, ", '), so use numeric for everything else.

Common mistakes

Forgetting the semicolon. Named references normally require a trailing ;. A small set of legacy names such as &amp and &copy are parsed without one for backward compatibility, but relying on that is fragile. &copysomething may or may not be read as the copyright sign followed by text, depending on the next character. Always write the semicolon.

Double encoding. If you run text through an escaper twice, & becomes & and then &. On the page the user sees the literal text &. This is the single most common entity bug. Encode once, at the boundary where data enters HTML.

Escaping for the wrong context. HTML escaping does not make a string safe inside a JavaScript block, a URL, or a CSS value. Each context has its own rules. Using & inside a <script> body will not decode; it appears verbatim to the JavaScript engine.

Assuming a name exists. There is no named entity for most Unicode characters. The named list is curated and stops well short of the 149,000+ assigned code points. When no name exists, the numeric form is your only entity option.

Related tools

Once your text is safe, other references on this site cover the neighboring problems. For picking and checking the colors around that text, use the Color Converter & Contrast Checker. For visual CSS effects, see the CSS Gradient, Shadow & Radius Generator. When you escape characters into a query string, the URL Parser & Query Editor handles the different percent-encoding rules that apply there. To confirm which key produced a character in the first place, the Keycode Inspector shows the raw event values, and the MIME Type Lookup helps you set the charset-aware content type that makes literal UTF-8 characters safe.

Related tools

CSS Gradient, Shadow & Radius Generator

Visual generators for gradients, box-shadows and border radii.

Color Converter & Contrast Checker

HEX ↔ RGB ↔ HSL ↔ OKLCH, plus WCAG contrast ratios.

URL Parser & Query Editor

Split a URL into parts and edit query parameters in a table.

curl Converter

Turn a curl command into fetch, axios, Python or PowerShell.

HTTP Status Codes

Search by code, phrase, or symptom — with retry/cache badges, causes, fixes, and RFC links.

Keycode Inspector

Press any key, see event.key, event.code and modifiers.