Lodash _.unescape() Method

Q: What does _.unescape() do?

_.unescape() converts HTML entities in a string back to their original characters—for example & becomes & and < becomes <.

Q: Is _.unescape() the opposite of _.escape()?

Yes. _.escape() converts &, , ", and ' to HTML entities. _.unescape() reverses those entities and a few named entities like &hearts;.

Beginner

⏱️ 7 min read

📚 Updated: Jul 2026

🎯 6 Examples + 3 Try It

String utilities

Overview

What You’ll Learn

By the end of this tutorial, you’ll use Lodash’s _.unescape() confidently in real JavaScript projects.

Core Syntax

Call _.unescape(string) on escaped text.

Reverse escape

Pair with _.escape().

HTML entities

Decode &, <, and named entities.

Stored content

Render escaped API or DB strings.

Security

Sanitize before assigning to innerHTML.

Cross-environment

Works in Node.js and browsers.

Fundamentals

What Is `_.unescape()`?

_.unescape() reverses HTML entity encoding—turning sequences like & and < back into & and <. It pairs with _.escape() for round-trip encode/decode workflows when storing or transporting text.

💡

Beginner tip

Think of _.unescape(stored) as “decode what _.escape() produced”—but always validate trust level before rendering HTML.

Foundation

📝 Syntax

javascript

_.unescape(string)

javascript

import unescape from "lodash/unescape";

const plain = unescape("Fast &amp; reliable &lt;widget&gt;");
// -> "Fast & reliable <widget>"

Cheat Sheet

⚡ Quick Reference

Task	Code pattern	Result
Basic decode	`_.unescape('<')`	<
Named entities	`_.unescape('&hearts;')`	♥
Round-trip	`_.unescape(_.escape(s))`	Restore literals
Quotes	`" → "`	Attribute values
Pair with escape	_.escape()	Encode for storage
Import	`import unescape from 'lodash/unescape'`	Per-method

Mutates?

No

Returns new string

Inverse

_.escape()

Encode/decode pair

Entities

HTML

Common set

Caution

XSS

Sanitize output

Reference

🧰 Parameters

stringRequired

The string containing HTML entities to decode.

return valueNew string

Decoded text with entities replaced by characters.

inverse_.escape()

Use escape when storing or transmitting HTML-sensitive text.

securityImportant

Unescaping user content for innerHTML requires sanitization.

Hands-On

Examples Gallery

Practical _.unescape() patterns with copy-ready code and interactive Try It Yourself labs.

📚 Getting Started

Core patterns for _.unescape() with copy-ready code.

Example 1 — Decode common HTML entities

Convert &, <, and > back to literal characters.

javascript

const escaped = "This &amp; That &lt; HTML &gt;";
const plain = _.unescape(escaped);

console.log(plain);
// -> "This & That < HTML >"

Try It Yourself

How It Works

Run the Try It editor to experiment with _.unescape() on your own strings.

Example 2 — Named entities (card suits)

Lodash decodes several named entities like &hearts;.

javascript

const suits = "Hearts: &hearts; Clubs: &clubs; Diamonds: &diams; Spades: &spades;";
console.log(_.unescape(suits));

Try It Yourself

How It Works

Run the Try It editor to experiment with _.unescape() on your own strings.

Example 3 — Round-trip with _.escape()

Escape for storage, unescape when rendering in a trusted pipeline.

javascript

const raw = 'Say "hello" & <welcome>';
const stored = _.escape(raw);
const restored = _.unescape(stored);

console.log("stored:", stored);
console.log("restored:", restored);

Try It Yourself

How It Works

Run the Try It editor to experiment with _.unescape() on your own strings.

📈 Practical Patterns

Real-world formatting and data-handling scenarios.

Example 4 — Quote entities in attributes

Unescape " when rebuilding attribute values from escaped sources.

javascript

const attr = "value=&quot;Lodash&quot;";
console.log(_.unescape(attr));

Example 5 — Process escaped API payload

Decode escaped description fields from a JSON API before display.

javascript

const item = { title: "Widget", body: "Fast &amp; reliable &lt;new&gt;" };
const displayBody = _.unescape(item.body);
console.log(displayBody);

Example 6 — Sanitize before innerHTML

Unescaping alone is not XSS protection—escape on output or use text nodes.

javascript

// Prefer textContent for user strings:
const user = _.unescape(userInput);
element.textContent = user;  // safe display

🧠 How `_.unescape()` Works

Receive string

Read the escaped source string.

Input

Match entities

Find &, <, named entities, and numeric forms.

Parse

Replace

Substitute each entity with its character.

Decode

Return plain text

New string with literals restored.

Output

Important

📝 Notes

_.unescape() is non-mutating and returns a new string.
Pair with _.escape() for symmetric encode/decode.
Do not use unescaped user strings with innerHTML without sanitization.
Named entities like &hearts; decode to Unicode symbols.
For full HTML5 entity tables, consider a dedicated library.
Next: _.upperCase() for word-aware uppercasing.

Wrap Up

Conclusion

_.unescape() restores literals from HTML entities—essential when reversing _.escape() output. Treat security seriously: decode only in trusted pipelines and prefer textContent for user-generated text.

Try unescape in the editor Next: Lodash _.upperCase()

Pro Tips

💡 Best Practices

✅ Do

Pair unescape with escape for symmetric storage pipelines
Use textContent when displaying decoded user text
Sanitize before innerHTML even after unescape
Test named entities your CMS actually emits
Import lodash/unescape per method

❌ Don’t

Assign unescaped user strings directly to innerHTML
Assume all HTML5 entities are supported
Use unescape as an XSS fix—it exposes markup
Decode twice without checking source trust
Skip escape on output after unescaping untrusted input

Summary

Key Takeaways

📄01

Decode entities

& → &

Core

📄02

vs escape

Encode/decode pair

Pattern

📄03

Security

Sanitize output

Critical

📄04

Named entities

♥ ♣ ♦ ♠

Feature

📄05

upperCase

Next method

Nav

❓ Frequently Asked Questions

What does _.unescape() do?

_.unescape() converts HTML entities in a string back to their original characters—for example & becomes & and < becomes <.

Is _.unescape() the opposite of _.escape()?

Yes. _.escape() converts &, <, >, ", and ' to HTML entities. _.unescape() reverses those entities and a few named entities like &hearts;.

Is it safe to use _.unescape() on user input?

Unescaping can expose HTML. Sanitize or escape on output. Never assign unescaped user strings to innerHTML without a trusted sanitization step.

Does _.unescape() decode all HTML entities?

It handles the entities Lodash documents—common named entities and numeric forms. For full HTML5 entity tables, consider a dedicated decoder.

When should I use _.unescape()?

When displaying content that was escaped for storage or transport, or when reversing _.escape() output before rendering in a controlled context.

How does _.unescape() compare to the DOM?

Creating a textarea or using DOMParser can decode entities in browsers. _.unescape() works consistently in Node.js and browsers without DOM APIs.

Did you know?

_.unescape is the inverse of _.escape()—but unescaping user content for innerHTML still requires sanitization. Prefer textContent when trust is unknown.

Practice _.unescape() in the Live Editor

Open the Try It editor and run the examples with your own strings.

Open Try It editor →

About the author

Mari Selvan M P 🔗

Developer, cloud engineer, and technical writer

Experience 12 years building web and cloud systems
Focus Full Stack Development, AWS, and Developer Education

I write practical tutorials so students and working developers can learn by doing—from databases and APIs to deployment on AWS.

AWS Certified Developer – Associate (Credly)

6 people found this page helpful

Lodash _.truncate() Lodash _.upperCase()

Lodash _.unescape() Method

What You’ll Learn

Core Syntax

Reverse escape

HTML entities

Stored content

Security

Cross-environment

What Is _.unescape()?

📝 Syntax

⚡ Quick Reference

🧰 Parameters

Examples Gallery

📚 Getting Started

Example 1 — Decode common HTML entities

How It Works

Example 2 — Named entities (card suits)

How It Works

Example 3 — Round-trip with _.escape()

How It Works

📈 Practical Patterns

Example 4 — Quote entities in attributes

Example 5 — Process escaped API payload

Example 6 — Sanitize before innerHTML

🧠 How _.unescape() Works

Receive string

Match entities

Replace

Return plain text

📝 Notes

Conclusion

💡 Best Practices

✅ Do

❌ Don’t

Key Takeaways

Decode entities

vs escape

Security

Named entities

upperCase

❓ Frequently Asked Questions

🧩 Related Lodash Topics

Lodash _.truncate()

Lodash _.upperCase()

Lodash _.escape()

Try: Basic unescape

Official Lodash docs

Practice _.unescape() in the Live Editor

About the author

What Is `_.unescape()`?

🧠 How `_.unescape()` Works