HTML Decode reverses HTML entity escaping, turning references like & or ' back into the literal characters they represent. It's useful when you've copied text out of a page's source, an API response, or an RSS feed and it still carries its escaped form.

How it works

Rather than re-implementing the full HTML5 named-character-reference table, the decoder creates a detached <textarea> element, sets its innerHTML to your input, and reads back .value. A textarea's content is always treated as plain text by the browser, so setting its innerHTML decodes any entities in the string without ever parsing them as executable markup — this delegates decoding to the browser's own HTML parser instead of a hand-rolled entity table, so it correctly handles named entities (&, ©), decimal (A), and hex (A) numeric references alike.

Features

Decodes named entities (&, <, ©, …) and numeric entities (decimal and hex)
Uses the browser's own HTML parser, so coverage matches what a real page would render
Safe on untrusted input — a textarea's content is never executed as script
Runs on keystroke or Cmd/Ctrl+Enter, entirely client-side

Example

Input: <div class="tools">Fast & private</div>

Output:

<div class="tools">Fast & private</div>

Edge cases

An unterminated numeric reference (missing the trailing semicolon, like &#65) is still decoded by most browser parsers under HTML5's error-recovery rules, so output can look permissive compared to a strict XML entity decoder. Text with no entities at all simply passes through unchanged. Decoding text that was never actually encoded, or that mixes real markup with entities, can produce confusing results since the tool decodes indiscriminately rather than trying to detect intent.

Best practices

Decode only when you need the literal characters for further processing or display outside HTML — if the decoded result is going straight back into an HTML page, you'll usually want to keep it escaped or re-encode it at that point to avoid reintroducing a markup-injection risk. When working with feeds or scraped content, decode once and store the plain-text form rather than repeatedly decoding on every render.

Spec

WHATWG HTML — Named character references

Frequently Asked Questions

What entities does this decode?▾

Standard named entities (&, <, >, ", ', and more) plus numeric entities like A or A.

Does decoding execute any scripts?▾

No — the decoder uses a plain textarea element, which never interprets its content as executable markup, so decoding is safe even on untrusted input.

Is my data uploaded anywhere?▾

No — decoding runs entirely in your browser.