Is it safe to decode HTML entities — can embedded JavaScript run?

Yes, it's safe. The tool uses `DOMParser` and reads only `textContent`, never `innerHTML`, so nothing gets parsed as live markup. Even an encoded `<script>` tag comes out as plain text, not runnable code.

What's the difference between HTML decoding and URL decoding?

HTML decoding converts entities (`<` → `<`) for display inside a document. URL decoding converts percent-encoding (`%3C` → `<`) for URLs and query strings. They're separate schemes, so a string encoded for one won't decode correctly with the other.

Why is the output still showing entities instead of plain text?

That's usually double encoding: `<` decodes to `<`, not `<`, because only one layer is removed per pass. Paste the output back in and run the decoder a second time to strip the remaining layer.

How do I decode < to < in JavaScript without a library?

The classic vanilla-JS trick assigns the encoded string to a hidden ` `'s `innerHTML`, then reads `.value` back out. This tool uses the safer `DOMParser` approach instead, which reads `textContent` without ever creating live DOM elements from the input.

Can I decode a large block of mixed content at once?

Yes. Paste the whole block — the tool decodes every entity it finds and leaves the rest of the text untouched.

HTML Entity Decoder

Decode HTML entities to plain text online — unescape <, >, &, " and all named entities instantly in your browser.

Updated April 2026

Encode Decode

Shift + Enter to Copy · Shift + ← → for tabs

HTML Entities Input

0 characters

Decoded Text

Speed

—

Privacy

Local Only

Size

0 KB

How it works

Three steps, no sign-up

1. Paste the encoded text

Any string with `<`, `&`, `"`, `©`, or numeric references like `<`.

2. Watch it decode instantly

The original text appears right away — there's no button to click.

3. Copy the result

Click Copy or press Shift+Enter to grab the decoded text.

What this HTML entity decoder handles

All three entity formats, fully supported

Named entities

Every HTML5 named entity (© → ©, € → €,   → a non-breaking space).

Decimal numeric references

References like < decode to <.

Hexadecimal numeric references

References like < decode to <.

Safe against XSS

Uses DOMParser and reads only textContent — never innerHTML — so embedded scripts never execute.

Examples

Encoded input

Decoded output

<div>

Tom & Jerry

"hello"

<br>

When you'll reach for this

The scenarios that come up most often

Debug an API response

Payloads that originated from HTML forms sometimes come back with entity-encoded strings.

Read a CMS export

WordPress, Drupal, and other CMSs store special characters as entities inside XML and CSV exports.

Inspect a raw HTML email

Raw MIME source of HTML emails is full of entities — decoding it reveals the actual message text.

Reverse-engineer scraped HTML

Content copied from a DOM inspector or pulled by a scraper usually comes out entity-encoded.

Validate a round trip

Encode, decode, then compare — a quick way to confirm your encoding logic isn't silently losing data.

Output not what you expected? Start here

Double encoding

&lt; decodes to <, not < — run the tool a second time on the result to strip the extra layer.

Confusing it with URL decoding

Entities use &name; syntax; percent-encoding uses %XX. They're different schemes — use the matching tool for each.

Why decode here

Everything runs in your browser through the native DOMParser — no text you paste ever leaves your device.

Unlike a hand-rolled regex, DOMParser fully covers the hundreds of HTML5 named entities plus both numeric formats — and it never executes embedded script, even when a decoded <script> tag shows up in the middle of your text.

Frequently asked questions

All named HTML5 entities ( , ©, €, —, and hundreds more), decimal references (<), and hexadecimal references (<) — all handled by the browser's native DOMParser.

References

MDN — Character reference

Mozilla's full reference for HTML character entities.

WHATWG — Named character references

The HTML5 specification listing every named entity.