HTML Entities: Complete Reference Table with Examples

HTML entities are special codes that represent characters in HTML documents. They exist because some characters have reserved meaning in HTML (like < and &), and others can’t be typed directly on a standard keyboard.

Why HTML Entities Exist

Three main reasons:

1. Reserved characters. The < character starts an HTML tag. If you want to display a literal < in your page, you must use < instead, or the browser will try to parse it as a tag.

2. Security. User-generated content that isn’t entity-encoded can contain <script> tags, leading to XSS (Cross-Site Scripting) attacks. Encoding < as < neutralizes this.

3. Special symbols. Characters like ©, ™, €, →, and — aren’t on most keyboards but have named HTML entities for easy insertion.

The Five Essential Entities

These are the characters you must encode in HTML content:

If you encode nothing else, always encode these five in user-generated content.

Common Symbol Entities

Typography

Currency

Legal and Math

Arrows

Three Entity Formats

Named entities — human-readable: &, <, €

Decimal numeric — Unicode code point in decimal: &, <, €

Hexadecimal numeric — Unicode code point in hex: &, <, €

All three produce the same result. Named entities are easier to read in source code, but not every character has a named entity. Numeric entities work for any Unicode character.

When to Encode

Always encode in these contexts:

<!-- In text content: encode < > & -->
<p>Use &lt;div&gt; for containers</p>

<!-- In attribute values: encode " (if using double quotes) -->
<input value="She said &quot;hello&quot;">

<!-- In user-generated content: encode ALL five essential characters -->
<div class="comment">{encodedUserContent}</div>

You don’t need entities for:

<!-- Modern UTF-8 documents handle these directly -->
<p>Café, naïve, résumé</p>

<!-- Emoji work directly in UTF-8 -->
<p>Hello 👋</p>

With UTF-8 encoding (which you should always use: <meta charset="utf-8">), you only need HTML entities for the five reserved characters and for characters you can’t easily type.

Security: HTML Entities and XSS Attacks

The most important practical use of HTML entities is preventing Cross-Site Scripting (XSS) — one of the most common web security vulnerabilities. XSS happens when an attacker injects malicious scripts into a web page viewed by other users.

How XSS Works

Without encoding, user input is interpreted as HTML:

<!-- DANGEROUS: If userName = "<script>alert('hacked')</script>" -->
<p>Welcome, {userName}</p>
<!-- Browser executes the script! -->

With proper encoding, the input is rendered as harmless text:

<!-- SAFE: The script tag is rendered as text, not executed -->
<p>Welcome, &lt;script&gt;alert(&#39;hacked&#39;)&lt;/script&gt;</p>

Types of XSS and How Encoding Helps

Stored XSS — malicious input is saved to the database (e.g., a comment, a profile name) and served to every user who views that page. Entity-encoding all output prevents the stored script from executing.

Reflected XSS — malicious input comes from the URL or form submission and is reflected back in the response. Encoding URL parameters before rendering them in HTML neutralizes the attack.

DOM-based XSS — malicious input manipulates the DOM directly via JavaScript. Entity encoding alone doesn’t prevent this — you also need to avoid injecting untrusted data into innerHTML, document.write(), or eval().

Framework Auto-Encoding

Modern frameworks encode by default, but each has an escape hatch:

If you must render raw HTML, always sanitize it first with a library like DOMPurify.

Defense in Depth

Entity encoding is the first line of defense, but a robust strategy combines multiple layers:

1. Encode all output — entity-encode user data when rendering in HTML
2. Content Security Policy — add a CSP header to restrict which scripts can execute
3. Input validation — reject obviously malicious input at the boundary
4. HttpOnly cookies — prevent scripts from accessing session tokens

Try It Yourself

Use our HTML Entity Encoder and HTML Entity Decoder to encode special characters or decode entity-encoded text — right in your browser.

HTML entities and URL percent-encoding are complementary — entities handle characters inside HTML documents, while percent-encoding handles characters inside URLs. For a quick comparison, the URL Encoding Cheat Sheet covers the percent-encoding side. If you’re working with APIs that return encoded data, you might also need Base64 decoding.

Further Reading

• MDN: HTML character references — Browser-supported entity reference
• W3C HTML5: Named character references — Complete list of 2,231 named entities
• OWASP XSS Prevention Cheat Sheet — Security best practices for output encoding
• MDN: Content Security Policy — Additional layer of XSS protection