HTML entity decoder
Decode named, decimal, and hexadecimal HTML entities back to text - including the mixed-form entities used to slip past XSS filters.
Open in ctfpalHTML entities exist so that < can appear in a document without starting a tag. They come in three forms - named (<), decimal (<), and hexadecimal (<) - and browsers accept sloppy variants of all three, including entities with leading zeroes and entities with no trailing semicolon.
Why the sloppy forms matter
That tolerance is the whole game in filter-bypass challenges. A filter looking for the literal string javascript: does not match javascript:, but the browser resolves the entity before parsing the URL and navigates anyway. Decoding a payload through every accepted form is how you work out which layer was fooled.
j- leading zeroes are permitted and unlimited.j- the semicolon is optional in attribute contexts.jandj- hexadecimal, either case.- Entities nested inside percent-encoding, which needs URL decoding first.
Worked example
Entity-obfuscated payload
Input
<img src=x onerror=alert(1)>Result
<img src=x onerror=alert(1)>Mixed hex and decimal entities in the same string - each one decodes independently.
Load this example in the workspaceRelated tools
URL decoder and encoder
Percent-decode and encode URL components, including double-encoded payloads and `+`-as-space form encoding.
Web attack payload catalog
Curated payloads for SQL injection, XSS, SSTI, SSRF, GraphQL, and deserialization, organised by what you are trying to establish.
Base64 decoder and encoder
Decode and encode Base64 and Base64-URL in the browser, with padding repair and automatic detection of nested encodings. Nothing is uploaded.
Hex to text converter
Convert hexadecimal to text and back, tolerating whitespace, commas, and `0x` prefixes. Runs entirely in your browser.