About HTML Decode
HTML decoding converts entities back into the characters they stand for — < becomes <, & becomes &, and a numeric reference such as € becomes the euro sign. Each entity is a placeholder for one character that could not be written literally in the surrounding markup.
The need to decode arises constantly when reading data rather than rendering it. Page titles, product names and descriptions scraped from a website arrive with their entities intact; an RSS feed or an API may return text that was escaped for HTML even though you intend to use it in a plain-text context such as a CSV export or a database field.
Named entities are worth knowing about because they are not always obvious. is a non-breaking space that looks identical to a normal space but is a different code point, and it will survive trimming operations that a plain space would not. Decoding makes such invisible differences visible.
How to use HTML Decode
- 1 Paste the text containing HTML entities.
- 2 The decoded characters are shown immediately.
- 3 Watch for resolving to a character that looks like a space but is not one — that is often the cause of an invisible mismatch.
Frequently asked questions
What is the difference between a named and a numeric entity?
A named entity uses a word, such as & or é, while a numeric one uses a code point, as & or é. Both refer to the same characters; numeric forms are more verbose but work even for characters that have no agreed name.
Why does my text contain characters that look like spaces but are not?
Almost certainly — a non-breaking space. It renders identically to a space but is a distinct code point, so it is not removed by trimming and does not match a normal space in a comparison. Decoding turns it into a visible character you can then find.
Should I decode data before saving it to a database?
It depends what the data is for. If it will be displayed in HTML, decode it and re-encode correctly at output time. If it will be compared, searched or exported as plain text, decode it so comparisons work against the characters a human would type.
Can decoding introduce a security problem?
Decoding itself does not, but it can expose a pre-existing one. If a decoder runs before content reaches an HTML template, a value that decodes to markup will be interpreted as markup. Decode when you need the plain text, not as a blanket step before rendering.
Free, online, and private
Free to use
HTML Decode is completely free. There is no account to create, no login, and no hidden charge or usage limit.
Runs online in your browser
It is a free online tool that runs entirely in your browser. Nothing to download or install — open the page and start using it right away.
Your data stays private
All processing happens locally on your device. Your input is never uploaded, stored, or tracked, so it never leaves your browser.
How HTML Decode behaves in detail
These are the specifics of this implementation — the exact ranges, defaults and fixed settings you are working with.
| Parameter | Value |
|---|---|
| Named entity table | 39 entries, looked up by exact spelling |
| Numeric forms | &#NN; decimal and &#xHH; hex, with either a lower or upper case x |
| Terminator | the semicolon is required; an undelimited entity is left alone |
| Astral code points | supported — String.fromCodePoint accepts values above 0xFFFF |
| Unknown entity | returned verbatim, not removed |
Compiled from the implementation of this tool and checked against it by itoolnet.
What HTML Decode does not do
Knowing the edges of a tool saves more time than another list of its features. These are the cases where it will not do what you might expect.
- The named table holds 39 entries against the several thousand the HTML5 specification defines, so names such as Α, ½ or → are left as literal text. Numeric escapes cover those cases; the named forms simply do not exist here.
- Entity names are matched case-sensitively, because the lookup is a plain object keyed on the exact spelling. & or &Nbsp; therefore stay literal even though browsers would resolve them.
- Decoding runs once and the output is not scanned again, so a double-escaped string like &lt; comes back as < — still an entity. Finishing that job takes a second pass through the tool.
Tested and documented by itoolnet, the team that builds and maintains this site.