String Escape / Unescape

The String Escape / Unescape tool is a free online utility that converts text to and from the escaped form required by programming and markup languages. Paste a string, choose a context such as JSON, JavaScript, HTML, XML, CSV, SQL, or unicode \uXXXX, and it rewrites quotes, backslashes, newlines, tabs, and non-ASCII characters into safe escape sequences — or reverses the process to recover the original text.

Everything runs client-side in your browser, so the strings you paste are never uploaded, stored, or seen by any server. That makes it safe for API payloads, database snippets, and configuration values you would rather not send anywhere.

How to escape or unescape a string

1. Paste or type your text into the Source string box.
2. Pick the target from the Escape context / mode dropdown (JSON, JavaScript, HTML, XML, CSV, SQL, unicode, or backslash).
3. Click Escape to produce the escaped literal, or Unescape to decode it back to plain text.
4. Leave Live on to re-run automatically as you type or switch modes.
5. Use Copy or Download to save the result, or Result → Source to chain another pass.

What does escaping a string mean?

Escaping is the act of replacing characters that have a special meaning in a given syntax with a safe sequence that represents the literal character instead. A double quote inside a JSON value, a < in HTML, or a single quote in a SQL literal would otherwise break the surrounding structure, so each context defines escape sequences — \", <, or '' — that keep the data intact. Unescaping simply runs that translation in reverse.

Why escaping matters

Correct escaping is the difference between valid data and a syntax error, and in the case of SQL or HTML it is also a core defense against injection bugs. Getting a stray backslash or quote wrong can corrupt an entire config file or API request, so a tool that handles the rules for you removes an easy class of mistakes.

Supported escape contexts

• JSON string — escapes quotes, backslashes, and control characters into a valid JSON string body while leaving readable non-ASCII intact.
• JavaScript string — handles single quotes, double quotes, backticks, and the usual \n, \t, and \r sequences for source-code literals.
• HTML — converts &, <, >, ", and ' to entities so text renders literally.
• XML — escapes the five predefined entities, including '.
• CSV field — wraps a field in quotes and doubles inner quotes per RFC 4180 when it contains commas, quotes, or line breaks.
• SQL string — doubles single quotes using the ANSI standard that works across most databases.
• Unicode \uXXXX and backslash — convert non-ASCII and control characters to and from escape sequences.

When to use this vs. other encoders

Reach for string escaping when you are embedding text inside a string literal — a JSON value, a JavaScript variable, or a SQL query. That is different from transport encoding: to make text safe inside a URL, the URL Encoder and Decoder applies percent-encoding, and to turn binary or text into an ASCII-safe blob you would use Base64 Encode and Decode. For web markup specifically, the HTML Encode tool focuses on rendering characters safely on a page, while the HTML Entity Converter maps characters to their named and numeric entities. Once you have unescaped a JSON payload here, the JSON Formatter is the natural next step to pretty-print and validate it.

String Escape features

• Eight contexts covering the escape rules developers hit most.
• Two-way conversion — escape and unescape from the same box.
• Live mode that re-runs the last action as you type.
• Edge-case aware handling of quotes, backslashes, newlines, tabs, and non-ASCII characters.
• Copy, Download, and Result → Source for fast, chainable workflows.
• 100% private — no uploads, no accounts, everything runs in your browser.

Frequently Asked Questions

Is my text sent to a server?

No. All escaping and unescaping happens locally in your browser with client-side JavaScript. Your strings are never uploaded, stored, or seen by any server.

What is the difference between escaping and URL or Base64 encoding?

Escaping makes a string safe inside a specific syntax such as JSON, SQL, or HTML by neutralizing characters that have special meaning there. URL encoding makes text safe to travel inside a web address, and Base64 turns data into an ASCII-safe representation. They solve different problems and are not interchangeable.

Does JSON escaping include the surrounding quotes?

No. The tool outputs the escaped string body so you can drop it between your own quotes. When unescaping, it accepts input with or without the wrapping quotes.

How does it escape SQL strings?

It uses the ANSI standard of doubling single quotes, which works across most databases. Escaping is a safety aid for building literals, but parameterized queries remain the best defense against SQL injection.

Can it handle newlines, tabs, and non-ASCII characters?

Yes. Newlines and tabs become sequences like \n and \t where the context requires it, and the unicode mode converts non-ASCII characters to and from \uXXXX escapes.

What happens if I try to unescape invalid input?

The tool validates as it decodes. If the input is not valid for the selected mode — for example malformed JSON escapes — it shows a clear error message instead of producing corrupted output.