Named and numeric references, both
HTML entities come in two notations.
- Named —
&,<, ,©and over two thousand more - Numeric —
é(decimal),é(hexadecimal)
Both are handled. This tool does not carry its own table of names; it hands the work to the browser's own HTML parser, so anything in the standard resolves.
What "decoding safely" means
The usual way to unescape entities is div.innerHTML = value followed by reading
textContent. But if the value contains <img src=x onerror=…>,
that code runs the moment you assign it. In a tool where you paste somebody else's log, that is
a real hazard.
This one uses DOMParser to build a separate document that is never attached to
the page, and pulls the text out of that. No script runs and no image request is made.
When breaks your string comparison
Text copied from a web page very often carries (U+00A0). On screen it
looks like an ordinary space, but in code trim() does not touch it and comparisons
quietly fail. Data pasted out of a spreadsheet or word processor behaves the same way.
If any survive the decode, the count is shown under the output box. Turn on turn non-breaking spaces into normal spaces to convert them.
What about values wrapped twice, like &lt;?
You get that when a template engine escapes an already-escaped value. Turn on
unwrap double escaping all the way and it repeats until nothing changes. Be
careful: it will also unwrap a body that genuinely contained the literal text
<, so use it while diagnosing rather than as a default.