Copied!
Text Tool

String Escape & Unescape Tool

Escape and unescape strings online for JSON, HTML, JavaScript, URL, CSV and SQL. This free tool handles backslash escaping, escape sequences for newline, tab and quotes, HTML entities, URL percent-encoding, and SQL injection prevention. Paste any string to instantly see the escaped or unescaped result. Supports Unicode \uXXXX notation, special characters, and all common escape formats. All processing happens client-side in your browser — nothing is uploaded to a server.

string-escape.tool
0 characters
0 characters
SequenceCharacterDescription
\\\Backslash
\""Double quote
\''Single quote
\nNewline (line feed)
\rCarriage return
\tHorizontal tab
\bBackspace
\fForm feed
\0Null character
\uXXXXUnicode code point (hex)

Frequently Asked Questions

What is string escaping and why is it needed?
String escaping is the process of replacing special characters with escape sequences so they can be safely included in strings, code, or data formats. For example, a double quote inside a JSON string must be written as \" to avoid prematurely ending the string. Without proper escaping, special characters like quotes, backslashes, newlines, and tabs would break parsers, cause syntax errors, or create security vulnerabilities such as SQL injection and XSS attacks.
How do I escape special characters in a JSON string?
In JSON, the following characters must be escaped inside strings: double quotes (\"), backslash (\\), newline (\n), tab (\t), carriage return (\r), form feed (\f), backspace (\b), and any Unicode control character using \uXXXX notation. JavaScript's JSON.stringify() handles this automatically. This tool performs the same escaping entirely in your browser.
What is the difference between HTML encoding and URL encoding?
HTML encoding converts characters to HTML entities (e.g., < becomes &lt;) so they display as visible text in web pages instead of being interpreted as markup. URL encoding (percent-encoding) converts characters to %XX format (e.g., a space becomes %20) so they can be safely included in URLs. They serve different purposes and are not interchangeable — HTML encoding prevents markup injection in pages, while URL encoding ensures characters are transmitted correctly in URLs.
How do I unescape a backslash-escaped string?
To unescape a backslash-escaped string, replace each escape sequence with its corresponding character: \n with a newline, \t with a tab, \" with a double quote, \\ with a single backslash, and \uXXXX with the corresponding Unicode character. This tool handles all standard escape sequences automatically. In JavaScript, JSON.parse() can unescape JSON-style escaped strings when the input is wrapped in double quotes.
Why is string escaping important for security?
Proper string escaping prevents injection attacks — the most common class of web security vulnerabilities. Without escaping, attackers can inject malicious code: SQL injection exploits unescaped quotes in database queries, XSS (Cross-Site Scripting) exploits unescaped HTML and JavaScript in web pages, and command injection exploits unescaped shell characters. Always escape user input before inserting it into SQL queries, HTML output, URLs, or shell commands.