HTML Entities Cheat Sheet
The characters you must escape, every common named entity with its decimal and hex code, and how to escape safely in each part of a page.
Cheat sheetPrintableFree, no login
Updated 28 October 2026
Encode text to named, decimal or hex entities, or decode any entity back to text.
Open the HTML entities toolEntity syntax
An HTML entity writes a character as text the browser turns back into the character. There are three forms, and all of them end in a semicolon:
| Form | Pattern | Example for © |
|---|---|---|
| Named | &name; | © |
| Decimal | &#number; | © |
| Hexadecimal | &#xhex; | © |
Named entities are case-sensitive (É is É, é is é). Numeric forms work for every Unicode character, including emoji: 😀 is 😀.
Characters you must escape
| Char | Named | Decimal | Hex | Description |
|---|---|---|---|---|
| & | & | & | & | Ampersand — always, everywhere |
| < | < | < | < | Less than — in text |
| > | > | > | > | Greater than — in text (recommended) |
| " | " | " | " | Double quote — inside double-quoted attributes |
| ' | — | ' | ' | Apostrophe — inside single-quoted attributes. ' works in HTML5 but not HTML4 |
Escaping these five is enough to show any text safely inside HTML elements and quoted attributes. Click any entity to copy it.
Spaces, dashes and quotes
| Char | Named | Decimal | Hex | Description |
|---|---|---|---|---|
| (space) | |   |   | Non-breaking space |
| (space) |   |   |   | En space |
| (space) |   |   |   | Em space |
| (space) |   |   |   | Thin space |
| | ­ | ­ | ­ | Soft hyphen (shown only at a line break) |
| – | – | – | – | En dash — ranges (1–5) |
| — | — | — | — | Em dash |
| … | … | … | … | Ellipsis |
| ‘ | ‘ | ‘ | ‘ | Left single quote |
| ’ | ’ | ’ | ’ | Right single quote, apostrophe |
| “ | “ | “ | “ | Left double quote |
| ” | ” | ” | ” | Right double quote |
| « | « | « | « | Left guillemet |
| » | » | » | » | Right guillemet |
| • | • | • | • | Bullet |
| · | · | · | · | Middle dot |
Symbols
| Char | Named | Decimal | Hex | Description |
|---|---|---|---|---|
| © | © | © | © | Copyright |
| ® | ® | ® | ® | Registered trademark |
| ™ | ™ | ™ | ™ | Trademark |
| § | § | § | § | Section |
| ¶ | ¶ | ¶ | ¶ | Paragraph |
| † | † | † | † | Dagger |
| ° | ° | ° | ° | Degree |
| ✓ | ✓ | ✓ | ✓ | Check mark |
| ✗ | ✗ | ✗ | ✗ | Ballot X |
| ♥ | ♥ | ♥ | ♥ | Heart |
| ★ | ★ | ★ | ★ | Black star |
Currency
| Char | Named | Decimal | Hex | Description |
|---|---|---|---|---|
| € | € | € | € | Euro |
| £ | £ | £ | £ | Pound |
| ¥ | ¥ | ¥ | ¥ | Yen / yuan |
| ¢ | ¢ | ¢ | ¢ | Cent |
| ₹ | — | ₹ | ₹ | Indian rupee (no named entity) |
| ₩ | — | ₩ | ₩ | Korean won |
| ₿ | — | ₿ | ₿ | Bitcoin |
Math
| Char | Named | Decimal | Hex | Description |
|---|---|---|---|---|
| × | × | × | × | Multiply |
| ÷ | ÷ | ÷ | ÷ | Divide |
| ± | ± | ± | ± | Plus-minus |
| − | − | − | − | Minus sign |
| ≠ | ≠ | ≠ | ≠ | Not equal |
| ≤ | ≤ | ≤ | ≤ | Less or equal |
| ≥ | ≥ | ≥ | ≥ | Greater or equal |
| ≈ | ≈ | ≈ | ≈ | Almost equal |
| ∞ | ∞ | ∞ | ∞ | Infinity |
| ½ | ½ | ½ | ½ | One half |
| ¼ | ¼ | ¼ | ¼ | One quarter |
| ² | ² | ² | ² | Superscript 2 |
| µ | µ | µ | µ | Micro |
| ‰ | ‰ | ‰ | ‰ | Per mille |
Arrows
| Char | Named | Decimal | Hex | Description |
|---|---|---|---|---|
| ← | ← | ← | ← | Left arrow |
| → | → | → | → | Right arrow |
| ↑ | ↑ | ↑ | ↑ | Up arrow |
| ↓ | ↓ | ↓ | ↓ | Down arrow |
| ↔ | ↔ | ↔ | ↔ | Left-right arrow |
| ⇐ | ⇐ | ⇐ | ⇐ | Double left arrow |
| ⇒ | ⇒ | ⇒ | ⇒ | Double right arrow |
Accented letters
| Char | Named | Decimal | Hex | Description |
|---|---|---|---|---|
| é | é | é | é | e acute |
| è | è | è | è | e grave |
| ê | ê | ê | ê | e circumflex |
| ë | ë | ë | ë | e diaeresis |
| ü | ü | ü | ü | u umlaut |
| ö | ö | ö | ö | o umlaut |
| ñ | ñ | ñ | ñ | n tilde |
| ç | ç | ç | ç | c cedilla |
| å | å | å | å | a ring |
| ø | ø | ø | ø | o slash |
| ß | ß | ß | ß | Sharp s |
| æ | æ | æ | æ | ae ligature |
Capitalise the first letter for the capital: É is É.
Escaping by context (preventing XSS)
- Inside an element (
<p>…</p>): escape&and<(and>for safety). - Inside a quoted attribute (
title="…"): escape&and the quote you used. Always quote attributes. - Inside
<script>,<style>, event handlers orhref="javascript:…": entities don't protect you. Never put untrusted data there — pass it as JSON in a data attribute instead. - In a URL attribute (
href,src): URL-encode the value first (URL encoding), then entity-escape the result, and allow onlyhttp:andhttps:links. - Prefer your framework's templating (React, Vue, Jinja, Razor…) — it escapes for you. Raw-HTML escapes like
dangerouslySetInnerHTMLand|safeturn that off.
Escape and unescape in code
| Language | Escape | Unescape |
|---|---|---|
| JavaScript (browser) | Set element.textContent = s instead of innerHTML | new DOMParser().parseFromString(s, 'text/html').body.textContent |
| Python | html.escape(s) | html.unescape(s) |
| PHP | htmlspecialchars($s, ENT_QUOTES, 'UTF-8') | html_entity_decode($s, ENT_QUOTES, 'UTF-8') |
| Java | StringEscapeUtils.escapeHtml4(s) (Apache Commons Text) | StringEscapeUtils.unescapeHtml4(s) |
| C# (.NET) | WebUtility.HtmlEncode(s) | WebUtility.HtmlDecode(s) |
| Go | html.EscapeString(s) | html.UnescapeString(s) |
| Ruby | CGI.escapeHTML(s) | CGI.unescapeHTML(s) |
Frequently asked questions
Which characters must be escaped in HTML?
& and < in text, plus the quote character inside quoted attributes. Escaping & < > " ' everywhere is the simple, safe rule.What is the difference between &nbsp; and a normal space?
is a non-breaking space: the line never breaks there, and several in a row don't collapse into one the way normal spaces do.Is &apos; valid HTML?
In HTML5 and XML, yes. HTML4 didn't define it, so
' is the safest way to write an apostrophe.Do I need entities for é, © or emoji?
No, if your page is saved and served as UTF-8 (
<meta charset="utf-8">). Type the characters directly. Entities are only needed for the special characters above, or when you can't type a character.Does escaping HTML prevent XSS?
It prevents XSS when untrusted text goes inside elements or quoted attributes. It does not protect script blocks, event handlers, CSS or
javascript: URLs — keep untrusted data out of those.