String Escaper – Escape & Unescape Strings Online

A string escaper rewrites characters that a format treats as syntax. Escaping does not change the meaning of the text. It changes how that text is written so a parser can tell data from syntax.

Escaping and encoding are different jobs. Escaping protects a string inside a language: quotes in JSON, tags in HTML, metacharacters in a regex. Encoding changes how bytes are represented for transport. Percent-encoding a URL is encoding. Turning a newline into \n inside JSON is escaping.

Context decides the rules. The same quote is \" in JSON, " in HTML, and untouched in a CSV field that is already wrapped in quotes. Using one format’s rules in another format is how strings get double-escaped or silently broken.

1. Paste or type the raw text, or the escaped text you want to read.
2. Choose Escape to produce the encoded form, or Unescape to turn it back into readable text.
3. Choose JSON, JavaScript, HTML, URL, regex, SQL, CSV, or XML. Quote and URL options appear only when that format uses them.
4. The output updates as you type. Fix the format if the result is not the context you are pasting into.
5. Copy the output or download it as a .txt file. The input stays on this page until you clear it.

JSON String Escaping

JSON escaping prepares text for a JSON string. Quotes, backslashes, and controls such as newline, tab, carriage return, backspace, and form feed follow JSON.stringify. Use it when a value is going into an API body. Surrounding quotes are optional, for when you need the whole literal instead of only the body.

Hello "World" becomes Hello \"World\". After you escape a fragment, the JSON Formatter can show whether the surrounding document is valid JSON.

JavaScript String Escaping

JavaScript escaping builds a string literal for single quotes, double quotes, or backticks. The chosen delimiter is escaped, and backticks also escape ${ so a template does not interpolate. Line and paragraph separators are written as \u2028 and \u2029.

Use it when pasting a path, a multiline log line, or user text into source. C:\Users\John becomes C:\\Users\\John.

HTML Escaping

HTML mode escapes &, <, >, quotes, and apostrophes so they render as text. It does not execute the input. It also does not decode the whole named-entity catalog. For  , ©, and numeric entities beyond those five characters, use the HTML Entity Encoder & Decoder.

URL Encoding

URL mode percent-encodes text. Component mode uses encodeURIComponent, which encodes /, ?, and &. Full URI mode uses encodeURI and leaves URL structure characters alone. Decoding uses the matching function and reports a bad % instead of dropping characters. For query strings and full addresses, the URL Encoder & Decoder is the dedicated tool.

Regex Escaping

Regex mode escapes literal text for a pattern, using RegExp.escape when the browser has it and the same syntax-character rules otherwise. Unescape is disabled: \d and an escaped literal are not safely reversible. Build the pattern here, then try it in the Regex Tester.

SQL String Escaping

SQL mode doubles single quotes, which is the standard SQL string rule. O'Brien becomes O''Brien. It does not add MySQL backslash escapes. Escaping a literal is not a substitute for a parameterized query. Application code should pass values as parameters.

CSV Escaping

CSV mode quotes a field that contains a comma, a quote, or a line break, and doubles quotes inside that field. A plain value with none of those characters is left alone. Unescape accepts either a plain field or one quoted pair.

XML Escaping

XML mode escapes &, <, >, quotes, and apostrophes with the five predefined entities, including '. Unescape also reads numeric character references. Control characters that XML 1.0 forbids are rejected instead of being written into the result.

The usual question is “how do I escape a string?” The useful version is “escape it for which parser?” Escaping quotes in a string means escaping the delimiter that literal uses. A JSON string and a JavaScript string both use backslashes, but a template literal also cares about ${.

“How do I escape a JSON string?” means quotes, backslashes, and controls. “How do I unescape a string?” or “how do I remove backslashes from an escaped string?” means reversing one layer and reading the result before doing it again. “How do I escape special characters?” depends on whether those characters are markup, a pattern, or a URL.

Regex questions are about matching the characters literally. URL questions are about percent-encoding. HTML questions are about showing < and & as text. This page covers those conversions and links to the tool that goes deeper when the job is only entities, only URLs, only patterns, or only a JSON document.

Using the wrong context

HTML entities will not make a JSON string valid, and JSON escapes will show up as raw backslashes in an HTML page.

Confusing encoding with escaping

Percent-encoding is for URLs. Base64 is for bytes. Neither one is how a JavaScript literal escapes a newline. Compare byte encodings with the Base64 Encoder & Decoder when that is actually the job.

Double escaping

Running escape twice produces \\\\ where one backslash belonged. Unescape one layer, check the text, then decide if another layer is really there.

Incomplete backslash handling

Replacing \n before \\ turns a literal backslash plus n into a newline. This tool scans sequences from the left instead of doing that replacement chain.

Forgetting newlines and tabs

A line break pasted into JSON or JavaScript is a control character, not the two letters \n, until it is escaped.

Treating HTML escaping as complete XSS protection

Escaping the five characters is the right step for HTML text. It does not sanitize URLs, event-handler attributes, or CSS. Context still matters.

Using SQL escaping instead of parameters

Doubling quotes fixes a string literal. It does not replace prepared statements, and it does not understand every vendor’s backslash rules.

Hand-escaping regex characters

A short list that misses / or { still compiles and then matches the wrong text. Escape the literal, then test the pattern.

• Need to clean and validate JSON after escaping it? Use the JSON Formatter.
• Need every HTML named entity, not only the five markup characters? Use the HTML Entity Encoder & Decoder.
• Need to encode a query string or a full address? Use the URL Encoder & Decoder.
• Need to see what a pattern matches? Use the Regex Tester.
• Need to encode bytes rather than escape syntax? Use the Base64 Encoder & Decoder.
• Need to compare text before and after escaping? Use the Text Diff Tool.
• Browse the rest of the set on Developer Tools.

Your text stays in your browser during normal use. Escape, unescape, copy, and download do not send it to EverydayTools for processing. The page can remember the format and options on this device. It does not store the text.

Match the format to the place you will paste the result. A converted string can still be wrong for a different parser, and SQL quote doubling does not replace parameterized queries.