HTML Encode
Encode special characters into safe HTML entities.
Encoding tool
HTML Decode
Convert HTML entities like the encoded ampersand and angle brackets back into their original characters, decoding both named entities and numeric character references. Everything runs 100% client-side in your browser.
100% client sideInstant resultNo data sent
How HTML Decoding Works
Decoding walks the text looking for an ampersand. When it finds one it reads forward to the next semicolon and inspects what sits between them. If the content is a known entity name it substitutes that character. If it begins with a hash it is a numeric reference, and the digits are read as a Unicode code point. If it begins with a hash followed by x it is hexadecimal. Anything that does not match a valid pattern is left exactly as it was found.
& named -> &
& numeric -> & (decimal code point 38)
& hexadecimal -> & (hex 26 = decimal 38)
€ numeric -> euro sign (code point 8364)
€ hexadecimal -> euro sign (same character)
Names are case sensitive: &Amp; is not a valid entity.
Worked Example
A product title pulled from a feed often arrives with everything escaped, including characters that never needed it.
Encoded:
Widgets & Gadgets ™ – 20% off, size < 10"
Step by step:
& -> &
™ -> trademark sign
– -> en dash
% -> %
< -> <
" -> "
Decoded:
Widgets & Gadgets (TM) (dash) 20% off, size < 10"
If the source was double encoded you will see &amp; in the input and a single & in the output. Decoding again gives the literal ampersand, and the presence of that pattern tells you an upstream pipeline is escaping twice.
Where You Meet Encoded HTML
- Scraped pages. Extracting text from markup leaves entities behind unless the scraper resolves them.
- RSS and Atom feeds. Titles and descriptions are escaped so they can sit inside XML elements, frequently twice.
- Database columns. Legacy applications that escaped on write rather than on render leave entities baked into stored rows forever.
- JSON API responses. Fields destined for a web page are often pre-escaped by the server, which breaks mobile clients that render plain text.
- HTML email. Marketing tooling escapes aggressively, and the raw source is full of and numeric references.
- CSV exports. Text pulled from a CMS and dumped to CSV keeps its entities and looks broken in a spreadsheet.
Decoding Reintroduces Risk
Never decode HTML and then insert it into a pageDecoding converts <script> back into a live tag. If you write that result into the DOM as markup, you have reversed the exact protection that made the content safe. Decode only when the destination treats the result as plain text: a terminal, a log, a text node, a spreadsheet cell, or a mobile label.
If you do need to render decoded content as markup, run it through a sanitiser that works on the parsed tree and allows only a known list of elements and attributes. Filtering with regular expressions is not sufficient, because the HTML parser accepts far more variations than any pattern will anticipate.
HTML Entity Reference Table
Named entities are easier to read, numeric entities work everywhere including XML where only five names are predefined. Both forms always end with a semicolon.
| Character | Named entity | Numeric entity | Description |
|---|---|---|---|
| & | & | & | Ampersand |
| < | < | < | Less than, opens a tag |
| > | > | > | Greater than, closes a tag |
| " | " | " | Double quotation mark |
| ' | ' | ' | Apostrophe or single quote |
| (space) | |   | Non-breaking space |
| © | © | © | Copyright sign |
| ® | ® | ® | Registered trademark sign |
| ™ | ™ | ™ | Trademark sign |
| – | – | – | En dash |
| … | … | … | Horizontal ellipsis |
| € | € | € | Euro sign |
| £ | £ | £ | Pound sign |
| ° | ° | ° | Degree sign |
| × | × | × | Multiplication sign |
Working on something related? Browse every free developer tool on the site, including a HTML encoder, URL decoder, Base64 decoder, and text utilities. Everything runs entirely in your browser, so nothing you paste is ever uploaded.
Frequently asked questions
4 answersMore JSON Tools
About HTML Decode
Scraped pages, exported database fields, RSS feeds, and API responses often arrive with their text still HTML encoded, full of entities that make the content hard to read. This HTML decoder reverses that encoding: it recognizes named entities, decimal numeric references, and hexadecimal references, and rewrites every one of them back to its original character in a single pass. It is ideal for cleaning up scraped content, inspecting encoded email bodies, and turning escaped markup back into readable text. Because it runs entirely in your browser, none of the text you decode ever leaves your device.