String Escape / Unescape

Escape a string for safe embedding in JSON, JavaScript, HTML, SQL, shell, or regex contexts. Or unescape strings copied from those contexts. Handles UTF-8 correctly.

How to use the String Escape / Unescape

Paste your string, pick the target context, choose Escape or Unescape. The escaped output is safe to drop into the chosen context. The unescape direction handles the same escape conventions as input.

Each context escapes differently

Embedding a string inside code means stopping certain characters from taking on special meaning. A double quote ends a JSON string unless you write \"; a < starts a tag in HTML unless you write <; a single quote breaks out of a SQL literal unless it is doubled. Every context — JSON, JavaScript, HTML, SQL, shell, regex — has its own set of characters to escape and its own way of doing it.

Getting this wrong is not just a syntax error; it is the root of injection bugs, where unescaped input becomes executable code or markup. This tool escapes a string for whichever target you choose and unescapes strings copied out of those contexts, handling UTF-8 correctly. It is a convenience for crafting test data and config by hand — in application code, always use your language's parameterized queries and built-in escaping rather than escaping by string substitution.

Common use cases

• Building JSON or config by hand — escape a value with quotes or newlines so it sits safely in a string field.
• Embedding HTML — convert <, >, and & so text displays literally instead of as markup.
• Shell commands — quote a string with awkward characters for a single-quoted shell argument.
• Regex literals — escape metacharacters so a fixed string matches itself rather than acting as a pattern.
• Unescaping copied strings — turn an escaped value from a log or source file back into its plain form.