Named vs Numeric HTML Entities: Names vs Code Points
Encoding Price: 5 < 10 & 10 > 5, "sale" isn't on. writes Price: 5 < 10 & 10 > 5, "sale" isn't on.. A named character reference is a mnemonic (<). A numeric one is the Unicode code point: decimal < or hex <. Encode writes & first so later passes cannot double-escape an entity. Apostrophe is ' because HTML 4.01 never defined '. Decode expands those five lowercase names plus numeric refs — < becomes <, but < stays written. The live regex also requires a trailing semicolon, so < stays written and < becomes <. Encode does not call String.prototype.normalize. Decode output of é writes NFC é (U+00E9). Decode output of é writes NFD e + U+0301. é stays written. Compose e + U+0301 to é (U+00E9) on /unicode-normalize/. Not and not the full HTML5 table. Nothing is uploaded.
Markup needs a way to write the characters that would otherwise start a tag or an entity. The live HTML encoder escapes five of them and decodes a small, named subset plus numeric references. This page names the three reference forms, the HTML 4.01 ' gap, and what a browser innerHTML parser would do that this tool does not.
How HTML entity encoding works
Encode writes the five markup characters as named or numeric references. Apostrophe is ', not '.
HTML encoding does not normalize Unicode
Encode does not call String.prototype.normalize. Non-ASCII letters stay as themselves, so encoding NFC é returns é and encoding NFD e + U+0301 returns e + U+0301. Decode output of é (or é) writes NFC é. Decode output of é (or é) writes NFD e + U+0301. é stays written. Composition under UAX #15 (e + U+0301 → é, U+00E9) is a separate step on /unicode-normalize/. The encoder leaves combining marks as typed.
Three ways to write the same character
Named: mnemonic, case-sensitive
HTML calls these named character references (HTML 4.01 said “character entity references”). The form is &name;. The five markup-significant names the live decoder accepts are amp (U+0026), lt (U+003C), gt (U+003E), quot (U+0022), and apos (U+0027). Names are case-sensitive. HTML5 also defines < for the same less-than; Docify does not expand that uppercase form.
Decimal: &#D;
HTML 4.01 §5.3.1: “&#D;” is the ISO 10646 (Unicode) decimal code point. Less-than is 60, ampersand is 38, apostrophe is 39. The live decoder parses the digits with Number.parseInt(..., 10) and then String.fromCodePoint. Zero, negative values, and anything above U+10FFFF stay as written.
Hex: &#xH; (XML wants lowercase x)
The same code point in hex: less-than is 3C. HTML 4.01 allows &#xH; or &#XH;. XML 1.0 requires a lowercase x. The live decoder regex is x[0-9a-fA-F]+, so < and < become <, but < stays written. Hex digits themselves are case-insensitive (3C and 3c). Encode never writes numeric refs for &, <, >, or " — only the apostrophe is numeric.
Ampersand first, apostrophe numeric
Why & is replaced first
Every character reference begins with &. If you first turn < into < and then escape every remaining ampersand, that entity becomes &lt;. Decoding once yields the six characters <, not a less-than. Encode therefore replaces & with & before <, >, ", and the apostrophe. Non-ASCII letters stay as themselves — this is not UTF-8 percent-encoding. Encoding NFC é returns é; encoding NFD e + U+0301 returns e + U+0301. Decode output of é writes NFC é. Decode output of é writes NFD e + U+0301. NFC normalization e + U+0301 → é (U+00E9) is /unicode-normalize/.
HTML 4.01 has no '
W3C HTML 4.01 §24 ships three entity sets: Latin-1 (including U+00A0 and © U+00A9), symbols and Greek, and markup-significant names. Those markup names include &, <, >, and ". There is no '. XML 1.0 predefined five entities and added it. WHATWG HTML’s named-character table later maps apos; to U+0027. A document served as HTML 4.01 may show the six characters ' literally. Decimal ' and hex ' are the same apostrophe in HTML 4.01, XML, and HTML5, so Encode always writes '. Decode still accepts '.
What Decode does not parse
Not the HTML 4.01 or WHATWG named tables
HTML 4.01’s Latin-1 list includes . WHATWG HTML lists more than two thousand named references (including many without a trailing semicolon, for legacy pages). Docify decode is a regex on those five names plus &# decimal or &#x hex, and that regex requires a trailing semicolon. A WHATWG HTML parser may expand the semicolon-less name lt; this page does not. Then String.fromCodePoint for scalars 1–0x10FFFF. Surrogates U+D800–U+DFFF stay written. So and © remain those strings unless you wrote the numeric form   or  .
Not innerHTML, not a sanitizer
Assigning a string to innerHTML parses markup: tags run, the full HTML named-entity table applies, and a <script> or event-handler attribute is a different job. This page does not do that. It is also not encodeURI or encodeURIComponent (spaces stay spaces; they do not become %20). Escaping five characters is not XSS protection and not a HTML sanitizer. Encode and Decode are buttons, not as-you-type.
Escape or decode the five markup characters
Ampersand first. Apostrophe is '. Nothing is uploaded.
FAQ
- What is the difference between named and numeric HTML entities?
- Named entities use readable names like &amp; for &. Numeric entities use code points like &#38; or &#x26;.
- Which entities are widely supported?
- Basic entities (< > & ") work everywhere. Some named entities are HTML5 only.
- When should I use entities?
- Use entities for < > & characters that have special meaning in HTML. Most other characters can be UTF-8.
- Does this tool upload my data?
- No. All encoding runs in your browser using JavaScript. Nothing is sent to a server.