Decode HTML Entities JavaScript: Methods That Actually Work

The safe one-liner: textarea

function decodeEntities(str) {
  const el = document.createElement('textarea');
  el.innerHTML = str;
  return el.value;
}

This works because textarea content is parsed as text: entities are resolved, but tags inside it are never executed or turned into elements. Reading .value gives the decoded string.

The critical detail is textarea specifically. The same code with a div would parse the input as markup, and an injected <img src=x onerror=alert(1)> would fire immediately.

DOMParser for larger input

const doc = new DOMParser().parseFromString(str, 'text/html');
return doc.documentElement.textContent;

DOMParser builds the document in an inert context — scripts do not run and images do not load — so it is safe for untrusted strings and handles very long input more predictably than the textarea approach.

It also decodes numeric references (&#8594;) and hex references (&#x2192;) alongside named ones, which hand-written replace chains routinely miss.

Why not innerHTML

element.innerHTML = untrustedString is the pattern behind a large share of DOM-based XSS. It parses the string as HTML and activates any event handlers it contains:

// dangerous — the handler fires immediately
el.innerHTML = '<img src=x onerror=alert(1)>';

// safe — decode first, then assign as text
el.textContent = decodeEntities(untrustedString);

textContent never interprets markup, so the value is displayed exactly as it reads. A manual replace chain for & < > " is also a bad idea: it misses thousands of named entities and gets the ordering wrong, decoding < into < when it should stay as the literal text <.

Node.js and server-side

There is no DOM in Node by default. Use the he package (he.decode) or entities — both are small, complete, and handle numeric and named references correctly.

If you already have jsdom or linkedom for other reasons, DOMParser is available through them and the browser code works unchanged.

Whatever you use, decode once at the point of display, not repeatedly through your pipeline. Double-decoding turns &amp;lt;script&gt; into an executable tag — the classic filter-bypass bug.