HTML Entity Decode
Runs 100% in your browserDecode named, decimal, and hexadecimal HTML entities back to readable text. Inspect entity counts, preview source safely, and copy or download decoded output locally.
Encode and decode HTML entities
Escape markup-sensitive characters as named, decimal, or hexadecimal entities — or decode them back to readable text. Runs entirely in your browser.
Input text
Entity settings
Output
Decoded text preview
Rendered as text, not live markupHTML source preview
Escaped source viewNothing to preview yet.
Entity conversion uses browser APIs only. Input is not uploaded, stored in localStorage, or interpreted as executable page markup.
Recent conversions
Recent conversions disappear when this page closes.
Frequently asked questions
An HTML entity decoder converts character references such as &, <, é, and 😀 back to their corresponding characters. It is useful when copied HTML source, API responses, or database values contain escaped text that needs to be read, transformed, or compared.
The decoder supports all standard named entities defined in the HTML specification, decimal numeric references such as ©, and hexadecimal numeric references such as ©. It also has an optional mode to handle common named references that are missing their trailing semicolons.
Yes. All named references with assigned HTML names are decoded, including (non-breaking space), © (copyright), ® (registered), ™ (trademark), typographic punctuation, currency symbols, and accented letters. Numeric references for any valid Unicode code point — including emoji such as 😀 — are decoded to their characters.
No. Decoding converts character references into characters and may reveal markup such as script tags or event attributes. Treat decoded output as untrusted data until it has been handled correctly in your application context. The ToolsSonic preview displays decoded text without injecting it as live HTML.
Decoding resolves character references and produces characters. Sanitizing analyzes markup structure and removes or restricts unsafe elements and attributes. Decoding is never a substitute for sanitization: decoded content may still contain dangerous markup that must be processed by a trusted HTML sanitizer before rendering.
Yes. Input can mix named references such as & and ©, decimal references such as ©, and hexadecimal references such as © in the same text. The decoder handles all three formats in a single pass.
Enable the option to tolerate entities missing a trailing semicolon. This safely decodes a common subset of named references that appear in older or hand-written HTML without the closing semicolon. References not in the safe subset are left unchanged to avoid decoding false positives.
The decoder converts character references and preserves ordinary whitespace and text content as supplied. It focuses on entity conversion rather than reformatting or normalizing the entire HTML document structure.
Yes. Use the paired HTML Entity Encode route or switch to the Encode tab. This is useful for checking a round-trip conversion, but be aware that if the original source was encoded more than once you may need multiple decode passes to reach the original text.
An entity may remain unchanged because it is incomplete or malformed, uses an unsupported name, was missing a semicolon with the semicolon-tolerance option disabled, or contains a code point the browser does not recognise. Check that the reference follows the &name; or &#number; format exactly.
No. HTML entity conversion happens entirely in your browser using browser-native parsing APIs. The page makes no network calls, writes nothing to localStorage, and keeps no persistent input records. The conversion history disappears when you close or reload the page.
No. This is a text-conversion and inspection tool, not a security scanner or sanitizer. For untrusted content in production applications, use context-aware output encoding at every output point and a trusted HTML sanitization library wherever user-supplied HTML must be rendered.
What is HTML Entity Decode?
An HTML Entity Decoder converts character references — named entities, decimal numeric references, and hexadecimal numeric references — back into their original characters. It is the essential companion to an HTML encoder, needed whenever you have HTML source that contains escaped text you want to read, transform, compare, or pass to another system.
Common situations where decoding is needed: reading an API response that returns HTML-encoded content fields such as <strong>Hello</strong>; extracting readable text from a database column that stored encoded HTML; inspecting a CMS template variable that contains double-encoded entities; reading email content that used named entity encoding for special characters; and checking whether a value was encoded once or multiple times.
Full entity vocabulary
The decoder supports all named entities defined in the HTML specification — not just the twenty or thirty that most basic tools cover. This includes all accented Latin characters (é, ñ, ç), Greek letters (α, ω), mathematical symbols (∑, ∞, √), currency symbols (€, £, ¥), typographic punctuation (—, “, ’), arrows (←, →), and playing card suits and other symbols. Decimal numeric references (©, €) and hexadecimal numeric references (©, 🚀) for any valid Unicode code point are also decoded, including emoji.
Tolerant semicolon handling
Older HTML documents, hand-written markup, and some CMS outputs contain named references without a trailing semicolon — & instead of &, © instead of ©. The optional semicolon-tolerance mode safely decodes a curated set of common references missing their terminator, without producing false positives on text that happens to start with an ampersand.
Non-executable output
The decoded text is displayed in a read-only textarea and a text-only preview element, never injected as live page markup. This matters because decoded text may contain <script> tags, event handler attributes, or other markup characters that would execute in a page. ToolsSonic treats all decoded output as untrusted text and lets you inspect it safely.
Decoding is not sanitization
This is the most important distinction to understand. Decoding resolves character references into characters. It does not analyze markup, remove elements, or restrict attributes. A decoded string may contain dangerous markup that requires a proper HTML sanitizer before it can be safely rendered. ToolsSonic's decoder includes a security guidance note that makes this distinction explicit, so developers using the tool during debugging do not mistake entity decoding for a security operation.
Why ToolsSonic HTML Decoder beats competitors
Most online HTML decoders — htmldecoder.com, toolsaday.com, and convertstring.com — offer a single textarea with minimal options and often upload your text to a server. ToolsSonic's decoder supports all HTML5 named entities, both decimal and hexadecimal numeric references, optional semicolon tolerance, entity count and byte-delta statistics, non-executable dual preview panels, copy output, download, swap, session-only history, and a clear decode-versus-sanitize security note. Every conversion runs locally in your browser.
Common use cases
- Reading HTML-encoded API response fields that contain escaped markup
- Extracting readable text from database columns that stored HTML-encoded content
- Decoding named entities, decimal references, and hex references in a single pass
- Inspecting whether a value was encoded once or double-encoded
- Preparing decoded content for a downstream context-aware encoding or sanitization step
- Decoding HTML email content that used entity encoding for accented characters and symbols
- Verifying round-trip losslessness by decoding previously encoded output
- Teaching developers the difference between decoding, sanitizing, and escaping HTML
Why use ToolsSonic's HTML Entity Decode?
ToolsSonic's HTML Entity Decoder supports the full HTML5 named-entity vocabulary, both decimal and hexadecimal numeric references, optional semicolon-tolerance, entity count and byte-delta statistics, non-executable dual preview panels (decoded text + escaped source), copy output, download, swap, session-only history, and an explicit decode-versus-sanitize security note — all without uploading text to a server. It is the most complete free HTML entity decoder available as a browser tool.
Related tools
HTML Entity Encode
Editor's choiceEncode HTML-sensitive characters and Unicode text as named, decimal, or hexadecimal entities. Preview safe source, copy or download output, and keep every conversion private in your browser.
URL Decoder
Decode percent-encoded URLs and query strings back to readable UTF-8 text — handles %20, +, Unicode escapes, mixed encoding, malformed escape checks, and local URL analysis.
Base64 Decode
Decode standard or URL-safe Base64 back to UTF-8 text locally. Handles Data URI prefixes, whitespace, missing padding, strict validation, malformed input errors, and readable output statistics.
HTML Editor
Editor's choiceEdit HTML with a live preview — synchronized source editor, WYSIWYG visual pane, sandboxed preview, 5 starter templates, format, minify, validate, find/replace, file import, and download. 100% in your browser.
JSON Escape / Unescape
Editor's choiceEscape raw text for a JSON string or unescape JSON string content back to readable text. Handle quotes, backslashes, control characters, Unicode, line breaks, tabs, and optional slash escaping privately in your browser.