HTML Unescape Online (Live Entity Decoder & Code Tool)
Decode named, decimal, and hexadecimal HTML entities back into readable markup, source code, and plain text. Features automatic recursive multi-pass decoding to resolve double-escaped entities (such as &) with 100% client-side privacy.
To unescape HTML entities, replace character references with their original literal characters: convert < into <, > into >, & into &, " into ", and ' into '. This restores encoded entities from API responses or database records back into executable source code.
The Double-Escaping Bug: Why `&lt;` Occurs
A frequent bug in content management systems (such as WordPress, Blogger, and database APIs) occurs when an application escapes an already-escaped string:
// Original Character: < // Pass 1 (Correctly Escaped for HTML storage): < // Pass 2 (Accidental Second Pass Escaping the '&' symbol): < • Displays literally as "<" on screen instead of rendering!
When double-escaping occurs, the browser renders the literal string < on screen rather than formatting the text. Our tool features an optional Recursive Multi-Pass Decoder that loops through up to 5 encoding layers to restore deeply nested entities back to their original characters.
HTML Entities & Symbols Decoding Reference Matrix
| Encoded Entity | Entity Category | Decoded Symbol | Unicode Code Point |
|---|---|---|---|
| < | Markup Delimiter | < | U+003C (Less Than) |
| > | Markup Delimiter | > | U+003E (Greater Than) |
| & | Entity Delimiter | & | U+0026 (Ampersand) |
| " | Attribute Delimiter | " | U+0022 (Double Quote) |
| ' | Decimal Entity | ' | U+0027 (Apostrophe) |
| | Whitespace | (space) | U+00A0 (Non-Breaking Space) |
| — | Typography | — | U+2014 (Em Dash) |
| © | Symbol | © | U+00A9 (Copyright) |
Security Warning: Preventing DOM-Based XSS When Unescaping
When unescaping HTML strings programmatically in web applications, developers must avoid injecting unescaped text directly into the DOM using element.innerHTML:
// DANGEROUS: Opens DOM-based Cross-Site Scripting (XSS)
const unescapedString = unescapeHtml(userProvidedInput);
document.getElementById('content').innerHTML = unescapedString;
// Any <script> or <img onerror> payload will execute immediately!
// SAFE: Use textContent for plain text, or sanitize with DOMPurify:
document.getElementById('content').textContent = unescapedString;
// Or: document.getElementById('content').innerHTML = DOMPurify.sanitize(unescapedString);
Related Web Security & Encoding Utilities:
- HTML Escape Online — Escape special characters into named, decimal, or hex entities to prevent XSS.
- Full HTML Entity Converter Hub — Complete character reference table for named and numeric entities.
- URL Percent-Encoding Converter — Encode query parameters under RFC 3986.
- URL Decode Online — Decode percent-encoded URLs and parse parameters into tables.
- HTML Entity Encoding for XSS Defense — Security rules and context boundaries.
Frequently Asked Questions
What does unescaping HTML mean?
Unescaping HTML is the process of converting entity references (such as <, >, and &) back into their original literal characters (<, >, and &) so they can be processed as standard source code or plain text.
How does this tool fix double-escaped entities like &amp;?
With the "Recursive Multi-Pass" option enabled, the tool performs multiple parsing passes, decoding outer entity wrappers until all nested layers are resolved back to the base character.
Is it dangerous to unescape HTML from untrusted users?
Yes. If you unescape HTML entities and render the raw result directly into a web page using innerHTML, any embedded <script> tags will execute, opening a Cross-Site Scripting (XSS) vulnerability. Unescaped strings must be sanitized before rendering.
Does this tool decode hexadecimal entities like <?
Yes. The tool accurately decodes named entities (<), decimal entities (<), and hexadecimal entities (<) into their identical literal character equivalents.
Is my data saved on a server during unescaping?
No. All entity decoding executes 100% locally inside your browser's runtime memory using the native DOMParser API. No text or code is transmitted across a network or saved in an external database.