How to use it
- Paste the text into Text, and choose Escape or Unescape in Action.
- Choose the kind of string in Format, such as JSON string or SQL string literal.
- For a quoted format, keep Add the quote marks ticked to get the text with its quotes, or untick it to get only the content.
- Read Result, and the Characters escaped table when you escaped the text.
What escaping means
A string in a program, a file or a query can hold only some characters directly. Escaping replaces the others, and the characters that would end the string, with a sequence that the format reads back as the same character. Each format has its own sequences, so one character can be written in several ways, and unescaping reads those sequences back into characters.
- JSON and JavaScript use a backslash, so a line break is written as \n.
- HTML and XML use an ampersand, a name and a semicolon, so an ampersand is written as &.
- CSV and SQL double the character that ends the field or string, so a single quote in SQL is written as two single quotes.
The rules of each format
- JSON string: RFC 8259, section 7. The quotation mark, the backslash and the control characters are escaped, and a \u escape with four hexadecimal digits is read.
- JavaScript string: ECMA-262 string literals. In a double-quoted string only the double quote needs escaping, and legacy octal escapes are refused.
- HTML attribute value: the five characters & < > " ' are written as references. A name this page does not know, such as é, is kept as it is.
- XML text: the same five characters, with ' for the apostrophe. XML 1.0 has no way to write a control character, so such characters are refused.
- CSV field: RFC 4180. A field with a comma, a quote or a line break is enclosed in double quotes, and each quote inside it is doubled.
- SQL string literal: the PostgreSQL manual. A single quote is doubled. A backslash is not special in standard SQL.
- Regular expression: a backslash goes before each syntax character, as ECMA-262 lists them. Unescaping keeps escapes such as \d, because they are classes.
- C# or Java string: the escapes both languages read. Line breaks are written as \n, and other control characters as \u escapes.
- Shell single-quoted text: POSIX. Nothing is special inside single quotes, so a quote is written as '\'' (end the quote, escape it, start again).
Mistakes that are easy to make
- Escaping a text twice doubles its backslashes, so the result shows \\n where the first escape gave \n.
- A JSON string placed inside a JavaScript file still needs its own escapes in the file, and a SQL string inside an application may need the escapes of the language too.
- Half of an emoji cannot be written in any of these formats, so the page refuses it. Type the character again.
Worked example: a JSON string with quotes, a line break and a backslash
The text He said "hi" & left., a line break, then Path: C:\temp has two quote marks, one line break and one backslash. Escaped as a JSON string with the quote marks, it becomes "He said \"hi\" & left.\nPath: C:\\temp". The table counts the characters that were written in another way.
| Character | Written as | Times |
|---|---|---|
| " | \" | 2 |
| U+000A | \n | 1 |
| \ | \\ | 1 |
Frequently asked questions
Is the text sent to a server?
No. Escaping and unescaping run in your browser, so text that holds a password or a token stays on your device.
Why does unescaping refuse \x41 in JSON?
JSON has no \x escape. It has \u followed by four hexadecimal digits, so the letter A is written \u0041. A JavaScript string does accept \x41, which is why the two formats are listed apart.
Why are single quotes left alone in a JavaScript string?
A string in double quotes needs only its double quotes escaped. With the quote marks option on, the result is wrapped in double quotes, so a single quote is an ordinary character there.
Why is a backslash not escaped in SQL?
Standard SQL does not treat a backslash as special in a string constant. Some databases, such as MySQL by default, do, so check the rules of your database before you write a backslash into an SQL string.
What does Add the quote marks change?
When it is on, the escaped text is wrapped in the quote marks of the format, such as double quotes for JSON or single quotes for SQL. Turn it off to get the content only, for example to put it inside a string that is already quoted.
Why does a CSV result have quotes when my text has no quote mark?
RFC 4180 requires a field to be enclosed in quotes when it has a comma, a quote or a line break. A plain field is written as it is, with no quotes.
Why is a control character refused for XML?
XML 1.0 does not allow characters such as U+0001 at all, not even as a reference, so the page cannot write them. Remove them from the text first.
Sources
- RFC 8259: The JavaScript Object Notation (JSON) Data Interchange Format, section 7 (IETF)
- ECMA-262: ECMAScript Language Specification, string literals and regular expression syntax
- XML 1.0 (Fifth Edition), section 4.6 predefined entities (W3C)
- RFC 4180: Common Format and MIME Type for Comma-Separated Values (CSV) Files (IETF)
- PostgreSQL manual: string constants (sql-syntax-lexical)
- POSIX Shell and Utilities, section 2.2.2 single-quotes (The Open Group)
- Java Language Specification, chapter 3: literals and escape sequences (Oracle)
- C# language specification, lexical structure (Microsoft)
- MySQL manual: string literals and the backslash escape character
Figures and text last checked on Tuesday, November 10, 2026.