Every developer has seen both & and \u0026. They both encode the ampersand character. But they are not interchangeable — they work in completely different layers of the stack.

Mixing them up produces a specific class of bug: the string that looks correct in your editor but renders wrong in the browser, or the one that displays fine but breaks in your JavaScript. This guide settles the difference once and for all.

What is an HTML Entity?

An HTML entity is a string that the HTML parser replaces with a specific character. There are three forms:

TypeExampleResult
Named entity&&
Decimal numeric&&
Hex numeric&&

Entities are resolved by the HTML parser before the DOM is constructed. By the time JavaScript sees the text, the entity has already been replaced with the real character.

Five characters must be escaped as HTML entities in text content: & (&amp;), < (&lt;), > (&gt;), " (&quot; in attributes), and ' (&apos; in attributes).

What is a Unicode Escape?

A Unicode escape is a JavaScript string literal syntax: \uXXXX where XXXX is the hexadecimal code point. It is processed by the JavaScript parser, not the HTML parser.

// These two lines produce the same string:
let a = "&";
let b = "\u0026";

Unicode escapes work in JavaScript source code, JSON strings, and some other programming contexts. They do not work in HTML attributes or text content.

The Critical Difference: Context

ContextUseExample
HTML text contentHTML entity&amp;
HTML attributeHTML entitytitle="Caf&eacute;"
JavaScript stringUnicode escape"Caf\u00e9"
JSON dataUnicode escape"city": "M\u00fcnchen"
CSS contentUnicode escapecontent: "\2713"

If you put \u0026 in an HTML file, the browser displays it as literal text \u0026 — it won't be interpreted. If you put &amp; in a JavaScript string, it stays as the literal ampersand entity string until the HTML parser processes it.

Common Pitfall: Server-Side Rendering

When you render HTML on the server (Next.js, PHP, Rails, Jinja), you must use HTML entities for user-generated content that contains special characters. Using Unicode escapes produces a string that the HTML parser never interprets.

// Wrong: JavaScript escape in HTML output
<div>{userInput}</div>  // userInput = "\u003Cscript>"

// Right: HTML entity in HTML output
<div>{escapeHtml(userInput)}</div>  // userInput = "&lt;script&gt;"

Testing It Yourself

Use the HTML Escape / Unescape tool to see how entities transform text, and the Base64 Encode / Decode tool for encoding to other formats.

TL;DR

HTML EntityUnicode Escape
ParserHTML parserJavaScript parser
ContextHTML files, templatesJS, JSON, CSS
Example&amp;\u0026
XSS-safeYes (in HTML)No (in HTML)

Know your context. In HTML, use entities. In JavaScript, use escapes. Never confuse the two.