NineClip Free Tools

HTML Decoder

Turn HTML entities back into their characters — the amp, lt, gt and quot references, plus any named or numeric reference — using the browser's own parser. Runs in your browser.

Developer Tools● Free No upload Instant

Loading HTML Decoder…

Your browser is preparing the tool. It runs 100% locally.

Quick Answer

Paste text full of HTML entities and the tool turns them back into the characters they stand for, using the browser's own HTML parser. It handles far more than the basic five: every named entity (the copyright sign, the em dash and hundreds more) and every numeric reference, decimal or hexadecimal, including emoji. It decodes through a detached, non-rendering element, so nothing in the input executes. It runs entirely in your browser.

What the HTML Decoder Does

Paste HTML-encoded text and you get the readable original: the amp reference becomes an ampersand, the lt and gt references become the angle brackets, and named references like the copyright or em-dash entity, plus numeric references in decimal or hex, all turn back into their characters.

It is the broad inverse of HTML encoding. Where the encoder touches only five characters, this decoder understands the browser's full entity table, so it can undo entities produced by any tool, content management system or template, not just the basic set.

How It Works

The tool sets your text as the inner HTML of a detached textarea element, then reads that element's value back. The browser's parser resolves every entity — named or numeric — to its character during that step, which is why the decoder is so complete: it borrows the same engine the browser uses to render pages.

A textarea is used on purpose. Its contents are treated as plain text rather than live markup, so even if the input contains a script or image reference, nothing runs or loads — the entities are decoded, but the markup stays inert.

Data source & conversion logic

  1. Take the encoded text. Read the entity-laden text you pasted.
  2. Hand it to the parser. Set it as the inner HTML of a detached textarea so the browser resolves the entities.
  3. Read back the value. Take the textarea's decoded text value — every named and numeric reference is now a character.
  4. Return it safely. Because a textarea treats content as text, no markup in the input runs or loads.

What it decodes

amp entity → ampersand lt entity → less-than gt entity → greater-than quot entity → double quote named references (copyright, em dash, and more) → their characters numeric references, decimal or hex → their characters

It decodes the browser's entire entity set, not just the five the HTML encoder produces — the pair is deliberately asymmetric.

Privacy

The text is decoded in your browser using its built-in parser; nothing is uploaded, so encoded content with private data stays on your device.

The decoder is built to be safe: because it resolves entities inside a non-rendering textarea, pasted markup is turned to text, not run. Even so, treat any decoded markup from an untrusted source with care before putting it into a live page.

Technical Details

Methodbrowser parser (detached textarea)
Decodesall named entities plus numeric (decimal and hex)
Scopebroader than the five-character encoder
Safetyinput not executed or rendered
ReversesHTML encoding, and entities from any source
Where it runsIn your browser — nothing uploaded

Standards & references

  • HTML character references — entities come in named form (an ampersand, a name and a semicolon) and numeric form (a decimal or hexadecimal code point); the browser parser resolves all of them.
  • Browser-native decoding — by using the browser's own parser, the tool decodes exactly what a real page would, covering the full entity table rather than a hand-written list.
  • Safe by construction — decoding inside a textarea treats the input as text, so scripts and other markup in the input do not execute or load.

Accuracy & Limitations

It decodes far more than the HTML encoder produces. The encoder here touches five characters; this decoder understands the browser's whole entity table, so it will happily undo a copyright sign, an em dash or a hex emoji reference that the encoder never creates. The pair is intentionally asymmetric.

A bare ampersand that is not part of a valid entity is left as-is. Browsers are lenient about these ambiguous ampersands, so stray ones in your input pass through unchanged rather than causing an error.

It expects entities, not percent-codes. A URL-style %20 is not an HTML entity and will not be decoded here — use a URL decoder for that. This tool only resolves HTML character references.

Decoded markup is inert in this tool but not automatically safe to reuse. The textarea stops anything from running here, yet if you paste the decoded HTML into a live page, the usual cross-site-scripting precautions apply.

Double-encoded entities decode one layer at a time. If text was encoded twice, one pass through this decoder removes one layer; run it again to fully restore the original.

Real-World Use Cases

Reading encoded HTML

Turn an entity-filled snippet back into readable text or markup.

Cleaning exported content

Decode entities in text pulled from a CMS, feed or database.

Debugging templates

See the real characters behind a string of references.

Recovering text

Restore quotes, dashes and symbols that were stored as entities.

When to use it — and when not to

Good for

  • Decoding any named or numeric HTML entity
  • Reversing HTML encoding from any source
  • Cleaning entity-laden CMS or feed text
  • Reading an encoded snippet as plain text

Not the best choice for

  • Decoding URL percent-codes
  • Guaranteeing decoded HTML is safe to reuse
  • Undoing Base64 or encryption
  • Encoding text into entities

Looking at percent-codes like %20? Use the URL decoder. Want to encode instead? Use the HTML encoder. Reusing the result in a live page? Re-encode or sanitise it for that context first.

Frequently Asked Questions

What does the HTML decoder do?
It turns HTML entities back into the characters they represent — the amp reference into an ampersand, the lt reference into a less-than sign, and any other named or numeric reference into its character.
Why does it decode more than the HTML encoder makes?
It uses the browser's full parser, which knows the entire entity table — hundreds of named entities plus all numeric references. The encoder only produces five, so the decoder is deliberately broader.
Does it handle numeric references?
Yes — both decimal and hexadecimal numeric references, including the ones for emoji and uncommon symbols. The browser parser resolves them all to their characters.
Is it safe to decode untrusted HTML here?
Decoding happens inside a textarea, which treats the input as text, so nothing runs or loads while you decode. But if you then paste the decoded markup into a live page, apply the usual sanitisation first.
Why is a lone ampersand left unchanged?
An ampersand that is not part of a valid entity is an ambiguous ampersand; browsers leave it as a literal ampersand rather than erroring, and so does this tool.
Can it decode percent-codes like %20?
No. Those are URL encoding, not HTML entities. Use a URL decoder for percent-codes; this tool only resolves HTML character references.
Is it the exact reverse of the HTML encoder?
It reverses it and more. Encoding five characters then decoding here returns your original, but the decoder will also undo entities the encoder never creates, because it understands the whole entity set.
Does it decode entities inside attributes too?
It decodes the entity text you paste regardless of where it came from. It treats the whole input as a string of text and references, returning the decoded characters.
What about double-encoded text?
Each pass removes one layer. If something was encoded twice, decode twice; the first pass turns the outer entities back into entity text, and the second restores the characters.
Is decoding the same as decryption?
No. Entities are a display encoding, not security. Decoding simply restores the original characters and breaks nothing.
Is my text uploaded?
No. Decoding runs entirely in your browser using its own parser; nothing leaves your device.
How do I encode text back into entities?
Use the HTML encoder, which escapes the five HTML-special characters into references.

References

Decodes entities by handing the text to the browser's own parser inside a detached textarea, so it resolves the full named and numeric entity set — far more than the five the encoder produces — while keeping the input inert (nothing runs or loads during decoding).

PopularHot

JSON Formatter

JSON Formatter for developers — instant, offline-style and privacy-safe.

DeveloperOpen Tool
Popular

JSON Validator

JSON Validator for developers — instant, offline-style and privacy-safe.

DeveloperOpen Tool
Popular

Base64 Encoder

Base64 Encoder for developers — instant, offline-style and privacy-safe.

DeveloperOpen Tool
Popular

Hash Generator

Fast, free Hash Generator that runs entirely client-side in your browser.

DeveloperOpen Tool
Popular

UUID Generator

Fast, free UUID Generator that runs entirely client-side in your browser.

DeveloperOpen Tool
Trending

CSS Minifier

Fast, free CSS Minifier that runs entirely client-side in your browser.

DeveloperOpen Tool

Ready to try the HTML Decoder?

It is free, private and runs entirely in your browser — no sign-up, no uploads, no limits.

Use the tool now Explore Developer Tools