HTML Decode
Turn & and ' back into real characters.
About this converter
Entities turn up in scraped pages, database columns, RSS feeds and anywhere text has been escaped once too often. This turns them back into the characters they stand for.
Both forms are handled: named entities like & and é, and numeric ones in decimal (—) or hex (—). An entity that is not recognised is left exactly as it was rather than guessed at or silently dropped — if you see one unchanged in the output, it was not a valid entity.
This is done by parsing the text rather than by handing it to the browser. The usual shortcut is to assign the string to an element and read its text back, which also executes anything hidden in an onerror attribute along the way. That is a real vulnerability in a surprising number of online decoders, and it is worth knowing about given what people paste into them.
Frequently asked questions
Why is one of my entities unchanged?
It is not a recognised entity. Rather than guess or drop it, unknown sequences are left exactly as they were, so you can see what was actually in the text. Common causes are a missing semicolon, or a stray & that was never escaped to & in the first place.
My text has & in it.
It has been escaped twice: & decodes to &, which decodes again to &. Run it through a second time. It usually means a value was escaped on the way into a database and again on the way out.
Does what I paste get sent anywhere?
No. The conversion runs in your browser, on your own machine — that is why the result appears as you type rather than after a wait. Nothing is uploaded, nothing is logged, and closing the tab is the end of it. This matters more here than on most pages: tokens, keys and internal data get pasted into tools like this constantly, and most of them are a form that posts to a server.