HTML Entity Decoder

Runs in browser Encoding

Convert named, decimal and hexadecimal HTML entities into their Unicode characters — supports the full HTML5 entity table.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

What are HTML entities?

HTML entities are escape sequences that let a page show characters HTML would otherwise interpret as markup: &lt; for <, &amp; for &, &quot; for a double quote, plus named and numeric references for any Unicode character (&copy;, &#169;, &#x00A9;). Encoding untrusted text this way before putting it in a page is what stops it from becoming script.

Security note: Text that reaches a page unencoded is the root of cross-site scripting. Encode on output, for the context it lands in (HTML body, attribute, JavaScript, URL) — decoding user input to "clean" it is not a defence.

How to use HTML Entity Decoder

  1. Paste text containing entities.
  2. Enable "Decode repeatedly" for double-encoded content.
  3. Check the warnings for unknown names.
  4. Copy the plain text.

HTML Entity Decoder features

  • Decodes named, decimal and hexadecimal character references
  • Windows-1252 remapping for &#128;–&#159; exactly as browsers do
  • Repeated decoding for double-escaped text (&amp;lt; → <)
  • Lists unknown entity names instead of silently dropping them
  • Tells you whether the result contains HTML markup

HTML Entity Decoder example

Decode a product description

Input:

Tom &amp; Jerry &copy; 2026 &mdash; caf&eacute; &#8230; &#x2713;

Output:

Tom & Jerry © 2026 — café … ✓

Frequently asked questions about HTML Entity Decoder

Which entities are recognised?

All numeric forms (&#NNN; and &#xHH;) plus the commonly used HTML5 named entities — Latin-1 symbols and accents, Greek letters, punctuation, arrows, math and card symbols. Unknown names are left untouched and listed.

Why does &#150; decode to an en dash?

Code points 128–159 are control characters in Unicode, but browsers interpret these numeric references as Windows-1252 characters for compatibility. The tool follows the HTML specification and does the same.

How do I decode &amp;lt;?

That is a double-encoded "<". Enable "Decode repeatedly" and the tool keeps decoding until no entities remain (up to five passes).

Are entities without a trailing semicolon decoded?

Numeric entities and a small legacy set (&amp &lt &gt &quot &nbsp &copy &reg) are, as browsers do. Other names require the semicolon to avoid corrupting text such as "AT&T".

Technical notes

Numeric references map directly to Unicode code points (with the historical Windows-1252 exception and replacement of NUL and surrogates). Named references are looked up in a table of the most common HTML5 entities. Legacy names without a trailing semicolon are only decoded for the small set browsers accept, so text such as "AT&T" is preserved.

References

  • HTML Living StandardWHATWGThe HTML language, including named character references (entities) and the parsing rules browsers follow.
  • Cross Site Scripting (XSS)OWASP FoundationWhat cross-site scripting is, its reflected / stored / DOM variants and how encoding prevents it.