TontonTools

HTML Decoder

Decode HTML entities — turn < and ' back into readable text.

100% Free No signup Privacy-friendly Web Development
Updated Sep 2026
Encode instead
Share X / Twitter Facebook LinkedIn WhatsApp

How to use HTML Decoder

  1. Paste the entity-riddled text — from an export, feed, or page source.
  2. Read the decoded result — <, é and friends become their characters.
  3. For double-encoded text, decode again — each pass removes one layer.
  4. Re-encode before rendering untrusted decoded content into a page — decoding revives markup.

What is HTML Decoder?

An HTML decoder converts entity notation back into real characters: &lt;<, &amp;&, &#39;', &eacute; → é — the full set of named, decimal and hex entities HTML defines.

Entity-laden text reaches you constantly: database dumps and API responses that stored escaped HTML, RSS feeds (which double-wrap content by design), scraped pages, log files, and the classic mangled paste where an apostrophe shows as &#39;. Decoding restores what a browser would have displayed.

About the HTML Decoder

Paste text containing entities and read it decoded instantly — names, decimal codes and hex codes all resolved.

The repair jobs it handles: exports and API payloads where titles arrive as "Tom &amp; Jerry's Caf&eacute;", RSS/Atom content whose escaped HTML you need as actual markup, text copied from page source rather than the rendered page, and the double-encoding archaeology — &amp;lt; decoded once gives &lt;, decoded twice gives <, each pass peeling one layer of a pipeline that escaped too enthusiastically.

The security flip side of decoding: decoded content may be live HTML. Decode to read or to repair data — but re-encode (HTML Encoder) before rendering anything untrusted back into a page, or the XSS protection that encoding provided is gone.

Frequently Asked Questions

Named (&amp;eacute; → é), decimal (&amp;#233; → é) and hexadecimal (&amp;#xE9; → é) — same characters, three spellings. HTML defines 2,000+ names; the numeric forms cover all of Unicode.
It was HTML-escaped when stored or exported — correct for display, wrong for raw data use. Decoding restores the apostrophes; ideally the pipeline stores raw and escapes only at output.
That's double encoding — decode twice: &amp;amp;lt; → &amp;lt; → <. Each decode removes one layer; stop when the text reads correctly.
Decoding itself just transforms text in your browser — nothing executes. Danger arrives only if you then inject the decoded (now live) HTML into a page unescaped — re-encode untrusted content before display.
By design — feeds carry HTML inside XML, so the markup is escaped to survive the wrapper. Consumers decode once to recover the article HTML; that's the format working as intended.

We use cookies for analytics and to keep the tools free via ads. See our Privacy Policy.