Make text safe to drop into HTML, or turn &, ' and friends back into readable characters.
| Char | Named | Numeric | When to use |
|---|---|---|---|
& | & | & | Always — starts every entity |
< | < | < | Always in text |
> | > | > | Recommended |
" | " | " | Inside double-quoted attributes |
' | ' | ' | Inside single-quoted attributes (' is HTML5 only) |
nbsp | |   | Non-breaking space |
© | © | © | Optional with UTF-8 |
— | — | — | Optional with UTF-8 |
€ | € | € | Optional with UTF-8 |
// JavaScript
const esc = (s) => s.replace(/[&<>"']/g, (c) => ({ '&': '&', '<': '<', '>': '>', '"': '"', "'": ''' }[c]));
# Python
import html
html.escape('<b>"hi"</b>') # <b>"hi"</b>
html.unescape('© 2026') # © 2026The JavaScript one-liner is itself a regex: a character class of the five special characters and a replacer function. Try variations in the regex tester. For URLs rather than markup, use the URL encoder.
In text content, & and <. Inside attribute values, & and the quote character that delimits the attribute. Escaping > and both quote types everywhere is the simple, safe habit — that is what the "Minimal" mode does.
It prevents it in HTML text and quoted attributes, which is where most templates put data. It does not make data safe inside <script> blocks, inline event handlers, style attributes or javascript: URLs — those need context-specific encoding. Frameworks like React, Vue and Jinja escape text by default.
Not if your page is served as UTF-8 (with <meta charset="utf-8">), which nearly every modern page is. Numeric entities are only useful when a file must stay pure ASCII.
© and © (decimal) and © (hex) all produce ©. Named entities are easier to read; numeric ones work for every Unicode character.