Turn HTML entities back into characters – named, decimal and hexadecimal – with a repeat mode for text that was escaped twice.
Show calculation steps
Processed privately in your browser — nothing you paste is uploaded, logged or stored.
Entities back to characters
HTML entities let markup carry characters that would otherwise be structural or hard to type. Decoding converts &, <, é and the named forms back to the characters they stand for.
Worked example
<p>café</p> → <p>café</p> &amp; → & (double-encoded)
Double encoding
&amp; appearing on a page means the text was escaped twice — typically once by an application and once by a template that assumed it had raw input. Decoding once shows the intermediate state, which identifies which layer is escaping when it should not.
Decoding is not safe by itself
Turning <script> back into a script tag produces exactly the payload the escaping existed to neutralise. Decoded output is data to inspect, not markup to insert into a page. Anything going back into HTML must be escaped again.
Limits
The decoder handles named and numeric entities and leaves anything else untouched so you can see it. Everything runs in your browser.
How to use the HTML Entity Decoder
- Paste the text containing entities.
- Turn on "Decode repeatedly" if you can see sequences such as &lt; that indicate double escaping.
- Click "Decode entities" and read the notes for any unknown or malformed references.
Frequently asked questions
Why did an entity survive decoding unchanged?
Because the name is not recognised. HTML entity names are case-sensitive and only a defined set exists, so a typo, an invented name, or an XML-only construct will be left alone and reported in the notes rather than guessed at.
What causes text like "&copy;" to appear on a website?
Double escaping: content that already contained entities was escaped a second time by a template or CMS. Each decoding pass removes one layer, and the repeat option unwinds the whole chain.
Is a missing semicolon acceptable?
Browsers tolerate it in some historical cases, and this decoder does too – but it reports each instance, because valid markup always terminates an entity with a semicolon and relying on the tolerance is fragile.
Does decoding entities make text dangerous to display?
The decoded text is returned as inert text and is never executed here. But if you take a decoded string containing angle brackets and insert it into a live page, it becomes markup again. Decode for inspection; re-encode before rendering.
