HTML Decoder

About the HTML Decoder

Paste text containing HTML entities, named codes, or numeric decimal and hex character references, and they are converted back to their original characters instantly. Decoding happens through an isolated, sandboxed textarea element that reads out plain text, so pasting hostile markup cannot execute anything or alter the page.

No part of this touches a server; the conversion runs locally in your browser the moment you type or paste.

• Standards-compliant HTML5 parsing, supporting over 2,000 named entity references.
• Numeric character references, resolving decimal (©) and hexadecimal (©) code points.
• Recursive multi-pass decoding, automatically resolving nested double-encoded and triple-encoded strings.
• Optional HTML tag stripping, isolating clean textual content from embedded markup tags.
• Client-side security sandbox, utilizing RCDATA element isolation to prevent script execution.

The three categories of HTML character references

HTML documents utilize character entity references to represent reserved characters, non-ASCII symbols, and invisible glyphs without triggering syntax errors in web browsers. These references fall into three distinct syntactical categories:

1. Named Character References: Human-readable aliases surrounded by an ampersand and semicolon. Examples include & (&), < (<), > (>), " ("), and © (©). The HTML5 specification catalogues 2,231 distinct named references.
2. Decimal Numeric Character References: Direct decimal representations of a character's Unicode code point prefixed by &#. For example, < resolves to the less-than sign, and € resolves to the Euro currency symbol (€).
3. Hexadecimal Numeric Character References: Base-16 hexadecimal representations of the Unicode code point prefixed by &#x or &#X. For example, < represents the less-than sign, and € represents the Euro symbol.

Security architecture: Why detached RCDATA textarea parsing prevents XSS

Naively decoding HTML using element.innerHTML = text creates severe security vulnerabilities. If the input text contains malicious payload markup such as <img src="x" onerror="alert(1)">, assigning it to a standard HTML element parses and executes the inline JavaScript immediately, exposing users to Cross-Site Scripting (XSS) exploits.

This HTML Decoder secures decoding through detached RCDATA parsing:

• The engine instantiates an unattached, off-screen <textarea> DOM node in memory.
• Under the official W3C and WHATWG HTML Living Standard, <textarea> elements operate under the RCDATA (Replaceable Character Data) content model.
• Within an RCDATA container, the browser HTML parser resolves all character entities into authentic Unicode glyphs, but treats all tag brackets (such as <script> or <iframe>) as plain text characters without executing them.
• Reading the textarea.value property retrieves the pure decoded text with complete safety.

Standard HTML entity reference table

Handling double-encoded and triple-encoded data pipelines

In modern web architectures, strings frequently pass through multiple processing stages (e.g., WordPress content filters, database sanitation layers, JSON API encoders, and RSS feed generators). If each layer blindly applies an encoding routine, entities become compounded:

• Original text: AT&T <HQ>
• First encoding pass: AT&T <HQ>
• Second encoding pass (Double-encoded): AT&T <HQ>

A single decode pass on a double-encoded string only reduces & to &. Enabling our Auto recursive decode option automatically executes successive decoding passes until the string reaches equilibrium, fully unpacking deeply nested entities in one click.

Comparison: Browser parser vs regex tables vs server-side libraries