How to escape or unescape a string
- Pick the format you are writing for, such as JSON, JavaScript, Python, or SQL.
- Choose Escape to make text safe to paste into code, or Unescape to turn escaped text back into plain text.
- Paste your text. Turn on "Wrap in quotes" to get a complete string literal, or "Escape non-ASCII" to write accents and emoji as \u sequences.
- Copy the result or download it.
Supported formats
JSON escape and unescape JSON string, JavaScript and TypeScript, Java and C#, Python, SQL (escape single quotes), CSV field, XML and HTML attribute, regex special characters, POSIX shell single quotes, URL percent-encoding, and Unicode \uXXXX escape sequences.
Unescaping JSON accepts the text with or without its outer quotes, and tolerates raw line breaks pasted from a document.
Questions
Is my text uploaded?
No. Escaping and unescaping run in your browser. Nothing is sent anywhere, so it is safe for tokens, queries, and private strings.
Is escaping SQL quotes enough to stop SQL injection?
No. Doubling single quotes helps when you build a one-off statement by hand, but application code should use parameterized queries. Never rely on manual escaping for user input.
What is the difference between escaping and encoding?
Escaping makes special characters safe inside one syntax, such as a backslash before a quote in a JSON string. Encoding, such as URL percent-encoding or HTML entities, replaces characters with a different representation. This page covers both for common cases.
Why does unescape say "Unknown escape"?
The text has a backslash followed by a character that format does not define, for example \q in JSON. Check that you picked the right format, or double the backslash if it should be a literal backslash.
Credits
Built by OneTooling using standard browser features. No third-party code runs on your data.