An entity is an escape: a way of writing a character that would otherwise be read as markup. < produces a less-than sign without starting a tag.
The enormous published list is a historical artefact. Most of it dates from before UTF-8 was universal, when writing a character directly was a gamble on the encoding.
The five
< and > — angle brackets. A bare < starts a tag, so if x < 5 written directly swallows the rest of the sentence into an element the browser then tries to make sense of.
& — the ampersand, because it starts an entity. Without it, Q&A and R&D occasionally resolve into something unintended, and URLs containing ©= famously produce a © in the middle of the link.
" and ' — the quotes, which matter inside an attribute value. A title attribute containing an unescaped double quote ends the attribute early, and everything after it becomes markup.
That is the complete list of characters that break HTML. Everything else is optional.
What you no longer need
Accented letters, currency symbols, arrows, mathematical symbols, Greek letters, emoji. Write them directly and declare UTF-8 at the top of the document.
é is harder to read than é, harder to search for, and no more correct. Writing → instead of → makes the source worse in exchange for nothing.
The exception is a genuinely uncertain pipeline — an email template, a system that mangles encodings, a file whose charset you do not control. There, entities are still the safe form, and the reason is the pipeline rather than HTML.
Two that are still worth typing deliberately
— a space that will not break across lines. Useful between a number and its unit, or before a final short word to avoid a widow. Worth writing on purpose, and worth not letting an editor insert on your behalf, since it is the most common invisible character to end up in text and break a search.
­ — a soft hyphen, marking where a long word may break. Rarely needed and genuinely useful in narrow columns of German.
Escaping and security
Escaping those five characters is the reason entities matter beyond typography: text from a user, inserted into a page unescaped, is a script tag waiting to run.
The part worth understanding is that the correct escaping depends on where the text lands. Inside an HTML body, escape the five. Inside an attribute, escape those and always quote the attribute. Inside a script block, entity escaping is the wrong tool entirely — JavaScript string escaping is a different rule. Inside a URL, it is percent-encoding. Inside a style block, something else again.
One escape function applied everywhere is a recognised way to produce a hole. Use the context-aware escaping your template engine provides, which is what modern frameworks do by default, and reserve manual escaping for the cases they cannot see.
Decoding
Text extracted from HTML frequently arrives with entities intact — Q&A rather than Q&A — and occasionally double-encoded, where &amp; means the escaping ran twice.
Decoding handles named entities, numeric ones like — and hexadecimal ones like — — three forms for the same character, all in circulation.
The short version
Five characters break HTML and everything else is optional. Declare UTF-8 and write the rest directly. Escape when inserting untrusted text, and escape for the context it lands in rather than reaching for one function everywhere.