HTML entities let you display angle brackets, ampersands, and other reserved characters as literal text — and are essential for preventing XSS security vulnerabilities. A complete guide.
HTML entities are a way of representing characters that have special meaning in HTML — or characters that are not on a standard keyboard — as safe text strings. If you have ever seen &, <, or ©in HTML source code, you have already seen entities in action. Here is what they are, when you need them, and how to encode and decode them instantly.
HTML uses certain characters as part of its syntax. The less-than sign (<) starts an HTML tag. The ampersand (&) starts an entity reference. The double quote (") closes attribute values. If you want to display these characters as literal text content on a webpage — not as HTML syntax — you need to represent them differently.
HTML entities solve this: each special character has a corresponding entity that the browser renders as the character itself, not as HTML syntax:
< displays as <> displays as >& displays as &" displays as "' displays as '© displays as ©® displays as ® is a non-breaking space<script> tag) from executing as code. This is a critical security practice.", ', and & in HTML attribute values need to be encoded.—), non-breaking spaces ( ), curly quotes (“, ”), and copyright symbols are commonly used entity references.× (×), ÷ (÷), and± (±) are cleaner as entities than as raw Unicode in HTML source.| Character | Named entity | Numeric (decimal) | Numeric (hex) |
|---|---|---|---|
| < | < | < | < |
| > | > | > | > |
| & | & | & | & |
| " | " | " | " |
| © | © | © | © |
| — | — | — | — |
Named entities are more readable; numeric entities work for any Unicode character even without a named entity reference. All modern browsers support both forms.
HTML encoding converts characters for safe use in HTML content. URL encoding (percent encoding) converts characters for safe use in URLs. They use completely different syntax and are not interchangeable. For URL encoding, use the URL Encoder / Decoder tool instead.
HTML entities are essential for displaying special characters correctly and for preventing XSS security vulnerabilities in web applications. The ToolsGravity HTML Encoder / Decoder converts between raw text and entity-encoded HTML in both directions. Use encoding any time you are inserting untrusted or angle-bracket-containing content into HTML, and use decoding to read or inspect entity-laden HTML source code.