HTML entities are character references used to safely represent special characters in HTML documents. Characters with special meaning in HTML syntax (<, >, &) would be interpreted as tags or syntax if written directly, so entities explicitly indicate "display as a character." Common examples include & (&), < (<), > (>), " ("), and ' (').

HTML entities come in two types: named references and numeric references. Named references like & are human-readable, with approximately 2,200 named entities defined in the HTML specification. Numeric references use decimal (&) or hexadecimal (&) notation to directly specify Unicode code points, allowing representation of characters without defined names.

From a web security perspective, converting characters to HTML entities (escaping) is fundamental to XSS (Cross-Site Scripting) prevention. When outputting user input to HTML, the five characters <, >, &, ", and ' must always be converted to entities. Failing to do so risks injection of malicious scripts. Most web frameworks provide auto-escaping in their template engines, but developers must explicitly escape when using innerHTML or dangerouslySetInnerHTML.

Commonly used entities in practice include the non-breaking space ( ), copyright symbol (©), trademark symbol (™), arrows (→), and mathematical symbols (×, ÷). The   entity is particularly frequent when displaying consecutive spaces or giving content to empty table cells.

A common misconception is that "entities are unnecessary when using UTF-8." While UTF-8 does allow direct inclusion of Japanese characters and emoji, escaping HTML syntax characters (<, >, &) is mandatory regardless of character encoding. Double quotes (") within HTML attribute values must also be converted to ".

For character counting, HTML entities create a discrepancy between source code character count and browser-rendered character count. & is 5 characters in source code but renders as a single "&" in the browser.   is 6 characters that become one space. Since counting HTML source characters versus counting rendered text characters yields very different results, it is important to understand which a character counting tool targets.