How to Decode HTML Entities Using JavaScript

To decode HTML entities in a string, use a browser textarea element when your code runs in a browser, or use the he package in a Node.js project. Both approaches convert character references such as  , ', and & to their corresponding characters. The example input also contains literal <h2> and <br> tags; decoding entities does not remove those tags.

Decode HTML Entities Using Vanilla JavaScript

A browser textarea can decode character references, but its innerHTML setter parses HTML syntax. Escape literal less-than signs before assigning untrusted input so a string such as </textarea><img src=x onerror=alert(1)> cannot close the parsing context or create an element. Character references still decode, and literal tag text remains text. This method requires document, so it runs in a browser rather than directly in Node.js.

Here is a complete browser page. Replace the sample string with the value you need to decode. The function escapes literal < characters before parsing, then the page displays the returned value with textContent.

<!doctype html>
<meta charset="utf-8">
<textarea id="source"></textarea>
<pre id="result"></pre>
<script>
function decodeEntities(input) {
  const textarea = document.createElement('textarea');
  textarea.innerHTML = input.replace(/</g, '&lt;');
  return textarea.value;
}

const input = "Give&nbsp;us some&#39;<h2>time</h2>&#39; &amp; space <br> Please";
document.querySelector('#source').value = input;
document.querySelector('#result').textContent = decodeEntities(input);
</script>

Escaping each literal < prevents the input from supplying a textarea end tag or other element markup to the parser. Encoded references such as < are still decoded, but the resulting < is text inside the textarea value; it is not parsed a second time as markup. The textContent assignment also displays the decoded <h2> and <br> characters as text. If you later intend to render decoded data as HTML, apply an appropriate HTML sanitization policy at that separate rendering step.

For a small Node.js example that handles semicolon-terminated decimal numeric character references, String.fromCodePoint() can convert each matched value that JavaScript accepts. This helper does not apply HTML’s numeric-character-reference rules: � becomes U+0000 and � becomes the lone surrogate U+D800, whereas an HTML parser replaces both with U+FFFD. The helper also does not validate malformed or out-of-range references, and an out-of-range value can make String.fromCodePoint() throw a RangeError. References without a semicolon are left unchanged. This is a narrow example rather than a complete HTML entity decoder; use the browser method above or the he package below for broader entity syntax.

Run this example:

function decodeDecimalReferences(input) {
  return input.replace(/&#(\d+);/g, (_, digits) =>
    String.fromCodePoint(Number(digits))
  );
}

console.log(decodeDecimalReferences("Give' us time"));

Give' us time

Decode HTML Entities Using he Library

For Node.js, install the he package with npm install he, then load it with const he = require('he'); and decode a string with he.decode(input). he supports named and numeric HTML character references, making it a better fit than a hand-written replacement list when input can contain varied entities. Check the package’s current Node.js engine requirements against your project’s Node.js version rather than assuming every version is supported.

The decode() function takes the HTML string as its required first argument. Its optional second argument is an options object; properties such as isAttributeValue and strict are boolean settings on that object, not separate values to pass directly. For ordinary text, call he.decode(input) without options. With the sample input above, the decoded string is Give us some'<h2>time</h2>' & space <br> Please (the space after “Give” is a nonbreaking space).

Choose the textarea approach for code that already runs in a browser and choose he for Node.js or when you need a standalone decoder with broad entity coverage. Decoding converts character references; it does not remove literal tags in the sample. Keep decoding and safe rendering as separate concerns.