HTML Decode

HTML decode entities into characters

The HTML decode tool converts character references back into real characters. It understands the full list of named references from the HTML5 specification as well as decimal (é) and hexadecimal (é) numeric references, for any Unicode character including emoji.

Example

Encoded input:

<p>Café crème © 2024 — €3.50 & "free" 🚀</p>

Decoded output:

<p>Café crème © 2024 — €3.50 & "free" 🚀</p>

Every entity in the input was converted: the named ones through the HTML5 table and the numeric ones directly from their code points, including the rocket emoji from its decimal reference. Characters that were already plain text simply pass through.

Where entity-encoded text comes from

• Web scraping output and the HTML source of pages, especially from CMSs that encode every non-ASCII character.
• RSS and Atom feeds, whose titles and summaries are often entity-encoded once or even twice.
• Database fields filled by forms that encoded input before storing it.
• Email templates and newsletters exported as HTML.
• API responses from services that HTML-encode strings “for safety”.

How decoding handles edge cases

• Missing semicolons. HTML5 lets a few legacy entities work without a semicolon, for example &copy 2024. The decoder follows the same rules as browsers.
• Invalid code points. References such as � or values in the surrogate range are replaced with the Unicode replacement character, exactly as a browser does.
• Double encoding. é decodes to é, not é. Decode again to remove the second layer.
• Plain text. Anything that is not an entity passes through unchanged, so you can paste mixed content safely.

Decoding entities in code

Python’s html.unescape() understands the full HTML5 list. In PHP, use html_entity_decode($s, ENT_QUOTES | ENT_HTML5) — without ENT_HTML5, newer names such as ' may be left alone. Java developers typically use StringEscapeUtils.unescapeHtml4() from Apache Commons Text, which covers the HTML 4 names only. In the browser, avoid the old trick of assigning text to innerHTML to decode it: with untrusted input it can execute scripts.

Decoding does not remove tags: <p> turns into a real <p>. If you want text only, run the result through the HTML Stripper. To encode text again, use HTML Encode.

The decoder runs in your browser and does not upload anything.

A safe way to decode in the browser

If you need to decode entities in front-end code, parse the string into a separate document instead of a live element. Documents created by DOMParser do not run scripts or load images, so hostile input cannot execute:

function decodeEntities(s) {
  return new DOMParser()
    .parseFromString(s, 'text/html')
    .documentElement.textContent;
}

decodeEntities('Café & crème');   // "Café & crème"

Note that this also drops any real tags in the input, keeping only their text. In Node.js, where there is no DOM, the he package offers he.decode() with the full HTML5 entity list.