How to Decode HTML Entities Back to Plain Text
HTML Decoding
When to HTML-Decode
Decode HTML entities when processing scraped content, normalizing CMS exports, reading encoded API responses, or converting stored entity strings back to readable text.
Real-World Examples
<div> → <div>
© 2026 Acme → © 2026 Acme
'quoted' → 'quoted'
Common Mistakes
- Decoding untrusted input then injecting it as raw HTML
- Assuming all named entities are supported in every environment
- Decoding twice and producing unintended characters
Edge Cases
- Numeric entities (
&#...;and&#x...;) may represent any Unicode code point - Malformed entities may pass through unchanged depending on the decoder
Security Considerations
Decoding user content and writing it into HTML without re-escaping recreates XSS risk. Treat decoded output as untrusted until sanitized for its destination context.
Developer Tips
- Use DOMParser or trusted libraries instead of regex for complex entity decoding
- Log before/after when migrating legacy content with mixed encoding
Frequently asked questions
Will decoding turn entities into active HTML?
Decoding produces characters like < and >. If you insert that output into a page as HTML, tags can become active — only insert as text or sanitize first.
What is the difference between named and numeric entities?
Named entities use labels like &copy;. Numeric entities use code points like &#169; or &#xA9;. Both decode to the same character.
Can I decode partial strings?
Yes. Decoders typically leave unrecognized sequences untouched and decode valid entities in place.