ConverterHTML Entity Decode
Read HTML named and numeric character references without rendering the result as markup. Decoded output remains untrusted text.
Decode Character References As Text
Browser-Compatible Parsing, Inert Presentation
A detached textarea uses the browser HTML character-reference parser for one decoding pass. The resulting value is assigned to a readonly textarea, not inserted as active HTML.
Unknown named references can remain literal. Invalid numeric references follow browser parsing behavior. Decoding does not sanitize the resulting text for future HTML rendering.
One-Pass Examples
| Input | Output |
|---|---|
| &lt; | < |
| 😀 | 😀 |
| &bogus; | &bogus; |
| <script> | <script> shown as text |
Trust Boundary
- Treat decoded event-handler text, tags, URLs, controls, and bidirectional characters as untrusted.
- Do not recursively decode until a string looks readable.
- Use a sanitizer and safe sink if a separate application intentionally renders markup.
Questions About This Tool
No. The result is written into a text control and is not rendered as HTML.
No. It is decoded text and may contain unsafe markup if another system later renders it.
The decoder performs one pass. Recursive decoding would change ambiguous data without an explicit instruction.