HTML Entity Decoder

To decode HTML entities, paste text containing entities like & or ' below — they're converted back to the literal characters (&, ', <, > …) instantly and locally. Toggle Encode to go the other way. Everything runs in your browser — nothing is rendered or uploaded.

How to decode HTML entities

HTML entities are escape sequences that stand in for characters which are reserved or awkward in markup — for example & for an ampersand or < for a less-than sign. To decode them, paste your text above with the toggle on Decode; each entity is turned back into the literal character it represents, and the plain text appears instantly. Click Copy to grab the result.

Named vs numeric entities

Every entity has a named form and one or more numeric forms — all decode to the same character. Named entities use a readable keyword; numeric entities use the character's Unicode code point in decimal (&#NN;) or hexadecimal (&#xNN;).

Is this safe and private?

Yes. Decoding is done by writing your text into a detached <textarea> element that is never inserted into the page, so the browser resolves the entities without rendering any markup or running any scripts — even if the input contains a <script> tag. And because it all happens in JavaScript on your machine, nothing is uploaded to any server. You can confirm in DevTools → Network: decoding fires no request.

Frequently asked questions

How do I decode HTML entities?

Paste text containing entities into the input above with Decode mode on. Entities like &, ', and < are converted back to their literal characters (&, ', <) instantly and locally, then click Copy.

What's the difference between named and numeric entities?

Named entities use a readable keyword, like & for & or < for <. Numeric entities use the character's Unicode code point in decimal (') or hexadecimal ('). Both forms decode to the exact same character.

Can I encode text into HTML entities too?

Yes — toggle the button to Encode. The tool escapes the characters that matter in HTML — &, <, >, ", and ' — into &, <, >, ", and ', which is enough to safely embed text in markup.

Is it safe to decode untrusted HTML here?

Yes. A detached <textarea> decodes the entities without ever attaching to the page, so no markup is rendered and no scripts execute. Everything stays in your browser and nothing is uploaded.