ETEvoraTools
Encoding & Decoding

HTML Unescape

HTML Unescape assigns the input to a detached textarea element and returns its text value, using the browser's HTML character-reference parser. Named and numeric references recognized in that parsing context can decode, while ordinary markup is represented as textarea text rather than executed. The result is still untrusted text and can become dangerous if inserted later with an HTML-executing API.

Runs locally — files stay on your device
#html#unescape#entities
Quick answer

Does unescaping make HTML input safe?

No. It only converts recognized references to characters.

Character references are parsed, not decrypted

References such as < and < are alternate spellings of characters. Decoding can recreate markup delimiters.

How it works

The browser parses the input as textarea inner HTML and the page reads the resulting textarea value in one pass.

Key concepts

One browser parse

&amp;lt; normally becomes &lt;, not a literal < in the same pass.

Danger can reappear downstream

Decoded angle brackets can regain markup meaning if later reparsed as HTML.

When to use it

  • Read copied text containing HTML entities.
  • Reverse the output of this page's HTML Escape tool.
  • Inspect numeric or named character references.

When not to use it

  • Do not inject the result as trusted innerHTML.
  • Do not expect recursive decoding of every nested escape.
  • Do not use it as HTML cleanup or validation.

Worked examples

Named reference

Input
&lt;p&gt;
Expected output
<p>

References become literal characters.

Numeric reference

Input
&#x41;
Expected output
A

Hex numeric syntax is recognized.

Nested escape

Input
&amp;lt;
Expected output
&lt;

The parse is not repeatedly applied.

Common mistakes

Trusting decoded text

It may contain active-looking markup. Correction: Keep it as text or sanitize for the final context.

Expecting recursive decoding

Nested escapes can remain. Correction: Understand the producer's encoding layers.

Using it as a validator

The browser can preserve unknown text. Correction: Validate against the required grammar.

Best practices

  • Decode only when the source format requires it.
  • Keep output in textContent-style sinks.
  • Avoid repeated decode cycles.

Related operations and differences

HTML Escape

Choose HTML Escape when you need to escape HTML-sensitive characters.; use HTML Unescape specifically for html unescape.

Base64 Decoder

Choose Base64 Decoder when you need to decode Base64 into readable text.; use HTML Unescape specifically for html unescape.

Base64 Encoder

Choose Base64 Encoder when you need to encode text as Base64 in your browser.; use HTML Unescape specifically for html unescape.

Binary to Text

Choose Binary to Text when you need to decode 8-bit binary groups into text.; use HTML Unescape specifically for html unescape.

Hex to Text

Choose Hex to Text when you need to decode hexadecimal bytes into text.; use HTML Unescape specifically for html unescape.

Random Token Generator

Choose Random Token Generator when you need to generate a cryptographically secure random token.; use HTML Unescape specifically for html unescape.

Limitations and privacy

  • Browser-dependent HTML parsing context, one pass, no sanitization, validation, recursive mode, or output-context protection.

The entered value is transformed locally in this browser and is not sent to the Toolbox server.

Copying or pasting sensitive output into another service is a separate disclosure decision.

Frequently asked questions

Will &lt; become <?

Yes.

Are scripts executed here?

The detached textarea is used for text decoding, but output must still be handled safely later.

Does it decode twice?

No.

Are unknown names rejected?

No explicit validation is performed.

References