Why do I see & instead of &?

Double-encoding. The text was escaped twice, so the & of & was itself escaped. Run the decoder a second time on the output to fully unwrap it.

What is the difference between ' and '?

Nothing but notation — the first is the decimal code point, the second the hexadecimal one. Both refer to the apostrophe character, and both decode identically here.

Is decoding HTML entities safe?

Decoding for reading is safe. Injecting the decoded output into a live page is not — that is exactly the escaping that prevents XSS, so always re-escape before rendering.

HTML Entity Decoder

Turn named and numeric HTML entities back into the characters they stand for.

live · client-sideData, Radix & Stringfree · no sign-up

RAW INPUT

DECODED

Output appears here as you type — decoded on your device.

Input is processed on your device. Nothing you paste is sent anywhere.

What is the HTML Entity Decoder?

An HTML entity decoder converts HTML character references — named ones like & and numeric ones like ' or / — back into the literal characters they represent.

HTML reserves a handful of characters for markup: <, >, & and quotes. To display them as text rather than have a browser parse them, they are written as entities — <, >, &, ". Any Unicode character can also be written numerically, in decimal (’) or hex (’), which is how content management systems and templating engines often emit smart quotes and dashes.

The result is text that looks broken when read outside a browser: scraped HTML, database rows and API responses arrive full of &amp; and '. This decoder resolves named and numeric references — including double-encoded ones, which is why &amp; appears so often after data has passed through two escaping layers.

Note the direction of trust: decoding entities produces raw characters. If you plan to insert the output back into a page, re-escape it. Unescaped HTML is how cross-site scripting happens.

HTML Entity Decoder at a glance

Named form: & < > "  
Numeric form: ' (decimal) · ' (hex)
Standard: HTML Living Standard character references
Reserved characters: < > & " ' must be escaped in HTML

How to use the HTML Entity Decoder

1Paste the escaped HTML or text containing entities.
2Named and numeric references are resolved instantly into plain characters.
3Copy the clean text — and re-escape it before putting it back into a page.

When you would reach for it

Cleaning scraped or exported HTML that arrived full of &amp; and '.
Reading an API response or log entry that was HTML-escaped by a framework.
Checking what a payload actually contains during an XSS or WAF investigation.

HTML Entity Decoder — frequently asked questions

Last reviewed 25 July 2026 · questions or corrections: contact@decoder.tools