HTML Entities Cheat Sheet

The Five You Must Escape

These are the only characters that break HTML if left raw, plus the quote characters that break attribute values. Every templating engine escapes these by default. Always escape them when inserting user-supplied content into HTML by hand.

Note on the apostrophe: the named form ' is part of XML and HTML5 but not HTML4. ' works everywhere and is the safer choice for output.

Whitespace and Punctuation

Common Symbols

Currency

Arrows

Math Symbols

Greek Letters (Common in Math & Science)

Named, Numeric, and Hex — All Three Forms

Every entity can be written three ways. They all render to the same character:

&copy;     <!-- named: most readable -->
&#169;     <!-- decimal numeric: works for any code point -->
&#xA9;     <!-- hex numeric: works for any code point -->

Use named entities when one exists — they're easier to read. Use numeric or hex for characters without a named form, or for any character above U+FFFF (where the hex form is the only practical option).

For characters with no named form, the numeric form is generated from the Unicode code point. The trumpet 🎺 has code point U+1F3BA — write it as 🎺 (decimal 127930) or 🎺 (hex). Both render as 🎺.

When You Actually Need Entities

Modern HTML is UTF-8 by default. You can write ©, €, α, and → directly in your source files, and they render correctly. Entities are required only in three situations:

1. Reserved characters: the five must-escape ones (&, <, >, ", ') need entities to avoid breaking the markup or attribute parsing.
2. Invisible characters: non-breaking spaces ( ), thin spaces, zero-width joiners. Easier to read in source as named entities than as raw whitespace you can't see.
3. Output to non-UTF-8 contexts: if your HTML is being served as anything other than UTF-8, or processed by a tool that mangles non-ASCII, entities sidestep the encoding problem.

Outside those cases, just type the character. The web has been UTF-8 by default since 2010 and the HTML5 spec mandates UTF-8 for all new documents.

Escape User Input — Always

The most important use of entities is escaping user-supplied content to prevent XSS. Any string that came from outside your code — a form input, a URL parameter, a database row originally written by a user, an API response — must be entity-escaped before being embedded in HTML.

// JavaScript — escape the five must-escape characters
function escape(s) {
  return s.replace(/[&<>"']/g, c => ({
    '&':'&amp;', '<':'&lt;', '>':'&gt;', '"':'&quot;', "'":'&#39;'
  }[c]));
}

// Python — html.escape from the standard library
import html
html.escape(user_input, quote=True)

Modern templating engines (React, Vue, Svelte, Jinja, ERB, Razor) escape by default and require an explicit opt-out (v-html, {{!}}, raw, etc.) to render unescaped HTML. Use those defaults; only opt out when you've already sanitized the input with a library like DOMPurify.

If you're escaping by hand for any reason, the HTML entity encoder/decoder handles both directions in your browser.