Free HTML Unescape - Decode Entities Online
HTML unescape for scraped or double-encoded text: &, < and other named or numeric references turn back into real characters. Switch modes to escape.
Input
Output
What Is HTML Unescaping?
HTML unescaping converts HTML entity sequences back into their original characters. If you've ever pulled content from a REST API or scraped data from a CMS and ended up with &, <, and " everywhere, you know the pain. These entities are necessary for safe HTML rendering (as outlined in the HTML Living Standard), but they make raw text unreadable. This tool converts them back so you can work with the actual content.
This tool starts in Unescape mode. Switch to Escape mode to convert special characters into HTML entities. Everything runs in your browser.
How to Use This Tool
Mode is Set to Unescape
This tool starts in Unescape mode. Switch to Escape if you need to convert characters to entities instead.
Paste or Upload Text
Paste the text or markup on the left, or bring it in from a file with Upload. Sample gives you a snippet full of angle brackets and ampersands to try both modes on.
Copy or Download Result
The right panel updates automatically. Use Copy or Download to save the result. To format HTML, try the HTML Formatter tool.
HTML Escape Examples
Escaping converts special characters to HTML entities so they render as text:
Raw input (with special characters)
Escaped output (HTML entities)
When HTML Escaping Matters
When you display user-provided content in HTML, you must escape it first to prevent Cross-Site Scripting (XSS) attacks. An attacker could inject <script> tags or event handlers that execute arbitrary JavaScript. Escaping renders those characters harmless as text.
Escaping is the reverse operation: it converts plain characters to HTML entities to prevent XSS. See the HTML Escape tool.
Frequently Asked Questions
Which entities get turned back into characters?
It decodes all named entities (&, <, >, ", ') and numeric entities (like — for em dash). The full list of named entities is defined in the HTML Living Standard.
Does the text I paste get uploaded anywhere?
No. Decoding is a few lines of JavaScript working on the text in this tab, so a scraped CMS export or an API response with customer data stays local. The DevTools Network tab will show nothing being sent while you decode.
When should I unescape vs escape HTML?
Unescape when you need to read or display the original text — for example, processing API responses or database exports that contain entities. Escape when inserting user content into HTML to prevent XSS attacks.
Can I use this for bulk text processing?
Yes. Paste any amount of text with HTML entities and the tool will decode all of them at once. For very large texts (100MB+), a command-line tool like PHP's html_entity_decode or Python's html.unescape() may be more practical.
Related Tools
The HTML Living Standard defines character references. MDN on HTML entities. The OWASP XSS guide explains why escaping matters for security.