HTML entity

An HTML entity, or character reference, is text like &, — or — that stands for a single character in HTML. It lets you write characters that would otherwise be read as markup, such as < and &, and characters that are hard to type or see.

Three ways to write a character

Every character reference starts with & and should end with ;. There are three forms, and all of them produce the same character:

Form	Example	Notes
Named	`—`	Readable; 2,125 names exist in HTML5
Decimal	`—`	The Unicode code point in base 10
Hexadecimal	`—`	The code point in base 16, matching U+2014

Numeric references work for any Unicode character and in XML as well. Named ones are specific to HTML: XML, and therefore SVG and XHTML served as XML, only defines &, <, >, " and '.

When you need them

On a UTF-8 page you can type almost any character directly, so entities are mostly needed for the characters HTML would misread. In text between tags that is & and <. Inside a quoted attribute it is & and the quote character used around the value. Escaping all five of & < > " ' is the safe default for both. Entities are also handy for characters that are invisible or easy to lose in an editor, such as the non-breaking space   and the soft hyphen .

Escaping for HTML doesn’t make a value safe everywhere on the page. A URL placed in href can still be javascript:…, and text inside <script> or <style> isn’t decoded as HTML at all. Those places need validation or their own escaping, such as percent-encoding for URL parts.

How browsers decode them

Browsers follow the HTML specification’s error-tolerant rules rather than rejecting bad references:

The longest matching name wins, and 106 older names (&amp, &copy, &not…) are accepted without the semicolon. An unescaped ?a=1&copy=2 in a page therefore displays as ?a=1©=2.
Names are case-sensitive: É is É, é is é.
 to  are read as Windows-1252 characters, so  shows an en dash.
References to invalid code points, such as a lone UTF-16 surrogate, display as the replacement character �.

Common mistakes

Double encoding, where escaped text is escaped again and the page shows &amp; or &quot; literally.
Encoding an emoji as two surrogate references instead of one reference to its full code point, like 😀.
Using   for layout, which breaks on narrow screens where CSS spacing wouldn’t.

Percent-encoding — Percent-encoding, also called URL encoding, writes a character as a percent sign followed by the hexadecimal value of each of its UTF-8 bytes, such as %20 for a space, so text can be carried safely inside a URL. It is defined in RFC 3986.