HTML Entity Decoder

HTML Entities, Decoded and Explained

HTML entities are character references that let you embed special characters in HTML source without breaking the markup. The most common ones — &, <, >, ", ' — encode the five characters that have syntactic meaning in HTML and would otherwise be parsed as markup or attribute boundaries. Beyond those, entities can represent any Unicode character, from accented letters to emoji.

This tool handles three formats interchangeably:

• Named entities — &, ©, —, …. There are about 250 named entities in the HTML5 spec; the decoder ships with the full list.
• Decimal numeric — &, ©, —. The number is the Unicode codepoint in base 10.
• Hexadecimal numeric — &, ©, —. Same codepoint, base 16. Both & (uppercase X) and & (lowercase x) are valid.

All three formats require a trailing semicolon to be reliably parsed. Browsers tolerate missing semicolons in some cases, but the spec — and this tool — does not.

Why You Need to Decode

You'll encounter encoded text in three main places:

• Web scraping — page source has Tom & Jerry; you want Tom & Jerry in your database.
• Double-escaped JSON — an API returns a JSON string field whose value contains HTML, and that value was HTML-encoded before being JSON-encoded. You need to JSON-parse, then HTML-decode.
• RSS/Atom feeds — feeds frequently encode the article body as HTML inside a CDATA or escaped string. To extract plain text, decode then strip tags.

Why You Need to Encode

The opposite problem is cross-site scripting (XSS). If you paste user-supplied text into HTML without encoding it, an input like <script>alert('xss')</script> becomes executable JavaScript in the visitor's browser. The fix is to encode the five HTML-special characters as entities before embedding:

• & → &
• < → <
• > → >
• " → " (only required inside attribute values, but harmless elsewhere)
• ' → ' (same)

Modern frameworks (React, Vue, Svelte, Angular) encode by default in template expressions — you only have to think about it when bypassing the framework with dangerouslySetInnerHTML, v-html, or equivalent. For server-side templating without auto-escaping (some older PHP, raw Express+EJS, etc.), encoding is your responsibility.

Doing the Same in Code

// JavaScript (browser) — leverage the DOM parser
function decodeEntities(s) {
  const t = document.createElement('textarea');
  t.innerHTML = s;
  return t.value;
}
function encodeEntities(s) {
  return s.replace(/[<>&"']/g, c => (
    { '&': '&amp;', '<': '&lt;', '>': '&gt;',
      '"': '&quot;', "'": '&#39;' }[c]
  ));
}

// Node.js
import { decode, encode } from 'html-entities';
decode('Tom &amp; Jerry');   // 'Tom & Jerry'
encode('<script>');         // '&lt;script&gt;'

// Python
import html
html.unescape('Tom &amp; Jerry')   // 'Tom & Jerry'
html.escape('<script>')           // '&lt;script&gt;'

Common Pitfalls

• Don't roll your own decoder with a few .replace() calls — you will miss entities and edge cases. Use the browser's DOM parser, a library, or this tool.
• Don't decode then write back as HTML without re-encoding — that defeats the purpose and reintroduces XSS.
• Watch for double-encoding bugs — if you see & in output, somewhere in your pipeline a string was encoded twice.
• UTF-8 is preferred over entities for non-ASCII characters in modern HTML — there's no need to write é when é is fine in a UTF-8 page. Entities are still useful for obfuscating mailto: addresses or when the encoding is uncertain.