HTML Entity Decoder Guide: Turning & Back into &
APIs return escaped quotes, emails are full of apostrophe entities, template variables print line-break tags. Decoding is fast; deciding whether this is the right layer to decode at is the hard part.
Open the tool：HTML Entity Decoder
Where the entities come from
Double escaping is the classic cause: content is escaped once before storage and again on output, so the page shows <. Email and RSS are the other common source, because their HTML handling is more conservative and often keeps entities intact.
Scraped API data hits it too: a JSON string keeps " in place, which makes the payload hard to read. Restoring the quote is usually the first step to telling whether the value is JSON, HTML, or just text.
- Diagnosing double escaping that produces <
- Reading escaped text from email, RSS, and APIs
- Making copied page source readable again
Decoding happens one layer at a time
The tool parses once as HTML: & becomes &, < becomes <, ' and ' become a single quote, and becomes a non-breaking space. If the source was &lt;, you get <, not <, because that was escaped twice.
Output is displayed as text and is not executed, so a restored script tag does not run. That can lull you into pasting the result back into a page, where, once it reaches innerHTML, it becomes a real tag again.
- One pass per click; double escaping needs two
- becomes a non-breaking space — a trap in code
- Text display only; scripts are not executed
Boundary: re-decide after decoding
Decoding is not sanitising. Once an entity becomes an angle bracket, the text has HTML meaning again. If it came from a user, it must be escaped for its output context before it goes back on a page, or you have reopened the injection hole yourself.
It also does not handle JavaScript unicode escapes, URL percent-encoding, or JSON escapes, which follow their own rules. Hexadecimal numeric entities such as 😀 decode fine, though characters above the BMP can still render inconsistently in old environments.
- Decoding is not sanitising; re-escape before reuse
- Does not handle \uXXXX, %XX, or JSON escapes
- Numeric entities work, but old systems may not render emoji
FAQ
Why does &lt; only decode halfway?
It was escaped twice. The first pass turns & into &, leaving lt; as ordinary text. A second pass produces the angle bracket. Seeing this usually means some stage is escaping twice, which is worth fixing at the source.
Can I paste the result into a page?
Not directly. Decoding returns raw characters, including angle brackets, which have syntactic meaning. Re-escape for the output context before inserting, or the text becomes markup.
What does decode to?
A non-breaking space (U+00A0). It looks like a normal space but is not collapsed by the browser and does not break across lines. Pasted into code, it causes strings that look identical but are not.
Related tool：HTML Entity Decoder