How to decode HTML entities
- Paste the entity-riddled text into the left Text with entities box, scraped HTML, RSS content, a database export, or a JSON API response. Decoding runs live.
- If the result still shows entities, the text was escaped more than once, copy the output back into the input and decode another level.
- Press Copy output once the text reads cleanly, or load Sample to watch an escaped anchor tag turn back into readable markup.
- Need to go the other way? Press ⇄ Swap to re-escape the decoded text.
The three entity forms it understands, with examples
An HTML entity is a stand-in for a character that would otherwise be ambiguous or hard to type, and it comes in three shapes, all of which decode here. Named references spell the character out: & becomes &, < becomes <, becomes a non-breaking space, and é becomes é. Decimal numeric references point at a Unicode code point, so é also becomes é and — becomes an em-dash. Hexadecimal numeric references do the same in base 16, so é is one more way to write é. Paste a whole line such as Tom & Jerry's "café" and it reads back as Tom & Jerry's "café".
Why you keep seeing entity-soup
Almost every system that stores or transports HTML escapes special characters on the way in, and the mess appears when two of them stack without anyone decoding in between, that's the origin of the notorious &amp;, where a single & has been escaped twice over. You'll run into it when scraping page content, reading RSS and Atom feeds, exporting a WordPress or CMS database, consuming JSON APIs that pre-escape their strings, or opening email templates. This decoder leans on the browser's own HTML parser running in a mode where nothing is rendered and no markup executes, so it resolves every standard entity exactly as a real page would, without any of the risk of actually displaying the input.
Decoding is the safe direction
It's worth being clear about what decoding does and doesn't do to your safety. Turning <script> back into <script> produces the literal characters as plain text in the output box, it never builds a live DOM node or runs anything, so pasting hostile-looking scraped HTML here is harmless. The caution belongs at the other end: if you take decoded text and inject it straight into a real web page, you've effectively un-escaped it into a context where a browser would parse it, which is how cross-site scripting happens. So decode freely to read content, but re-escape with the HTML Entity Encode tool before you place any untrusted text back into live markup.
Frequently asked questions
What are HTML entities?
Text codes that stand in for characters with special meaning in HTML: & for &, < for <, for a non-breaking space, and numeric forms like é for é. Decoding converts each one back to the character it represents.
Why does my text show & instead of &?
It was escaped twice, often by two systems in a row, such as a CMS and then a feed generator. Decode once and, if entities remain, run the output through again; each pass removes one layer.
Does the decoder handle numeric entities?
Yes. Decimal references like é and hexadecimal ones like é decode alongside every standard named entity such as é, — and …, all three resolve to the same characters a browser would show.
What is and why does it look like a normal space?
is a non-breaking space (Unicode U+00A0). It decodes to a space character that looks ordinary but won't wrap or collapse, handy in HTML, occasionally surprising when it sneaks into data you're trying to parse.
How do I escape text into entities instead?
Use the HTML Entity Encode tool to turn <, >, & and quotes into safe entities, or press ⇄ Swap here to re-encode the decoded text.
Is it safe to paste scraped HTML here?
Yes. Tags stay as literal text and scripts never run, decoding happens entirely in your browser, in a non-rendering parser, and nothing you paste is transmitted or stored.