HTML Unescaper

Introduction

Escaped HTML often appears when markup or symbols need to travel as ordinary text. A less-than sign can become <, an ampersand can become &, and a copyright mark can become ©. Those spellings prevent characters from being interpreted too early, but they also make copied CMS content, email fragments, log lines, and code samples harder to read.

Unescaping reverses that representation. Character references turn back into the Unicode characters they name or number, so the text becomes easier to inspect. The important safety point is that decoding changes visibility, not trust. A decoded <script> string is easier to spot than <script>, but it still needs to stay as text unless the destination has its own sanitizer and review process.

Named reference

A readable HTML name such as ©, &, or <.

Decimal numeric reference

A base-10 code point form such as < for the less-than sign.

Hex numeric reference

A hexadecimal code point form such as < or <.

Semicolonless reference

A legacy-compatible spelling such as &copy that some HTML parsing paths accept, but that can be ambiguous in source review.

Escaping depth is easy to misread. One decode pass turns < into <. A double-escaped fragment such as < first becomes <, then needs a second pass before the less-than sign appears. Nested escaping is common after text crosses more than one storage, email, translation, ticketing, or logging system.

Strictness matters because HTML keeps some older reference spellings for compatibility. A browser-style decode may accept missing semicolons for names such as &copy, while a stricter source review may need that token to stay visible. Unicode normalization is a separate choice. It can make visually equivalent text easier to compare, but compatibility normalization can also fold characters that were distinct in the original source.

The safest habit is to decode for inspection, not for rendering. Treat unresolved references, replacement characters, tag-shaped text, and script-shaped text as review clues. Unescaping helps reveal what a string contains; it does not sanitize HTML, remove dangerous code, or decide whether the decoded output belongs in a page.

How to Use This Tool:

Start with the escaped text, choose how strict the decode should be, then use the ledger and audit rows to decide whether the output is ready to copy.

1. Paste content into Escaped HTML, use Browse file, or drop one TXT, HTML, or HTM file onto the textarea. Files larger than 1 MB show a size warning instead of loading.
2. Set Decode passes from 1 to 6. Use 1 for ordinary escaped text and 2 for common double-escaped fragments such as <. Decoding stops early when a pass makes no change.
3. Choose Reference mode. HTML5 tolerant follows browser-style resolution for accepted legacy forms, while Strict semicolons decodes only references that end in ;.
4. Open Advanced when comparison or cleanup requires it. Leave Unicode normalization as No change for the closest decoded text, choose NFC or NFKC for matching work, and enable Trim outer whitespace only when edge whitespace should be removed.
5. Read the summary badges before copying. Decoded text ready means no unresolved or strict-skipped references remain, while Decoded with unresolved references, Markup text, or Script signal means the output needs review.
6. Use Decoded Text for the readable result, Entity Ledger for reference-by-reference evidence, Safety Audit for warning signals, and JSON when a structured record is useful.

Interpreting Results:

The decoded text is the main result, but the counts explain whether it is complete. No entities found means the input did not contain reference-shaped tokens that matched the scanner. If the decoded count is lower than the total reference count, check Entity Ledger for Skipped or Unresolved rows before assuming the text is finished.

Text only is a first-pass safety signal, not a security guarantee. Markup text means the decoded output contains tag-shaped strings. Script signal is stronger because it looks for script tags, iframes, embedded objects, event-handler attributes, and javascript: text. Keep those results as text until a separate sanitizer or code review says they are safe for the intended destination.

Repeat checks need the same settings. Changing Decode passes, Reference mode, Unicode normalization, or whitespace trimming can change the final text, ledger statuses, audit rows, and copied output, especially when nested escaping or semicolonless names are present.

Technical Details:

HTML character references use an ampersand-led token to stand in for Unicode text. Named references depend on the HTML named-character table, while decimal and hexadecimal numeric references point directly at a Unicode code point. Several spellings can map to the same character: <, <, and < all resolve to the less-than sign.

The semicolon is the clearest delimiter for a reference. HTML keeps legacy compatibility for some names without the semicolon, which is why &copy may still become the copyright symbol in tolerant parsing. That lenience is useful for copied web text but risky for audits, because adjacent letters and digits can change where a parser decides the name ends.

Transformation Core

Unescaping is a bounded transformation over reference-shaped tokens. Each pass scans the current text, replaces tokens that resolve, records evidence for every detected reference, and gives the changed text to the next pass only when another pass may reveal nested escaping.

Numeric references can expose invalid or unusual Unicode results. A replacement character in the output usually means decoded text contains a value that could not be represented as an ordinary character. The audit marks replacement characters for review because they often indicate damaged encoding, copied binary data, or a reference that was legal-looking but not meaningful for the destination.

Reference and Output Signals

NFC normalization composes canonically equivalent Unicode where possible, which is useful when accents or combining marks should compare the same. NFKC also applies compatibility folding, so full-width forms, ligatures, and other compatibility characters may become more ordinary-looking text. That can help search and matching, but it can erase distinctions that mattered in the original source.

The audit is deliberately conservative. It searches for common markup-shaped and script-bearing patterns, counts unresolved references, and records replacement characters, but it is not a complete HTML parser or cross-site scripting scanner. Security still depends on the context where the decoded text will be used: plain text, HTML body, attribute value, script, style, URL, and rich-text editor contexts all need different handling.

Limitations, Privacy, and Safety Notes:

• Pasted text, dropped text, small file reading, decoding, ledger rows, audit rows, and exports are handled in the current browser session after the page loads.
• TXT, HTML, and HTM file loading is capped at 1 MB so a very large source does not make the browser-side review sluggish.
• Script and markup signals are pattern checks. They help surface risky-looking output, but they are not a full sanitizer, parser, or vulnerability assessment.
• Unicode normalization can change exact characters. Leave it off when the original decoded text must be preserved byte-for-byte after character references are resolved.

Advanced Tips:

• Use Strict semicolons for source audits where missing delimiters should remain visible. Use HTML5 tolerant when the goal is to see what browser-compatible text will usually become.
• Increase Decode passes only until nested escaping is exposed. The pass limit is 6, and decoding stops early when a pass no longer changes the text.
• Choose NFC for ordinary canonical matching of accents and combining marks. Choose NFKC only when compatibility folding is acceptable for the review job.
• Keep Trim outer whitespace off when copied snippets need exact leading or trailing spaces. Turn it on for cleanup only after the decoded text has been inspected.
• Use Entity Ledger before copying output from a double-escaped source. It shows which pass changed each reference and which tokens remained skipped or unresolved.

Worked Examples:

Double-escaped CMS text

A copied fragment such as <article class="notice">Tom & Jerry</article> needs Decode passes set to 2. Decoded Text becomes <article class="notice">Tom & Jerry</article>. Entity Ledger shows the first pass exposing nested references and the second pass resolving them, while Safety Audit reports a markup signal because the result contains tag-shaped text.

Strict review of a missing semicolon

With Reference mode set to Strict semicolons, Copyright &copy 2026 & Co. leaves &copy unchanged and decodes & to &. Entity Ledger marks the missing-semicolon token as Skipped, and the summary includes an unresolved count. Add the semicolon or switch to HTML5 tolerant only when browser-compatible lenience is the desired reading.

Script-shaped output after one pass

The source <script>alert(1)</script> decodes in one pass to visible script markup. Decoded Text displays it as text, Safety Audit reports Script signal, and the warning text explains that the output should not be rendered without review. That result is useful for a ticket or code review because it makes hidden markup visible.

File too large to load

Dragging a 2 MB HTML export onto Escaped HTML produces the file-size warning instead of decoding. Split the export, paste a smaller excerpt, or save a text sample that is 1 MB or smaller. Once the source loads, the Input size row in Safety Audit confirms the character count being reviewed.

FAQ:

Glossary:

Character reference

An ampersand-led HTML sequence that represents another Unicode character.

Named reference

A character reference that uses a name from the HTML named-character table, such as ©.

Numeric reference

A decimal or hexadecimal character reference that points to a Unicode code point.

Decode pass

One scan through the current text, replacing references that resolve during that scan.

Semicolonless reference

A reference-shaped token without the usual trailing semicolon, accepted by some tolerant HTML parsing paths.

Unicode normalization

A post-decode rewrite that converts Unicode text into NFC or NFKC form for comparison or matching.

Script signal

An audit finding that decoded text contains script-bearing patterns such as event handlers, script tags, or javascript: text.

References:

• HTML named character references, WHATWG HTML Living Standard.
• Character reference, MDN Web Docs.
• Unicode Standard Annex #15: Unicode Normalization Forms, Unicode Consortium.
• Cross Site Scripting Prevention Cheat Sheet, OWASP Cheat Sheet Series.