String Escape / Unescape Tool
Escape and unescape strings for JSON, JavaScript, HTML, XML, URL, CSV, SQL, and regex. Free online tool.
How to Use
- Select Escape or Unescape mode.
- Choose the target format (JSON, JavaScript, HTML, XML, URL, CSV, SQL, or Regex).
- Paste or type your string in the input area.
- The result appears instantly in the output panel.
- Click Copy to copy, or Swap to reverse.
Escaping by Format
JSON escaping handles double quotes, backslashes, and control characters (newlines, tabs). It follows the JSON specification (RFC 8259), converting " to \" and newlines to \n.
JavaScript escaping is similar to JSON but also handles single quotes. This is essential when building strings in JavaScript source code.
HTML/XML escaping converts <, >, &, ", and ' to their entity equivalents (<, >, etc.). This prevents XSS attacks and ensures proper rendering in web pages.
URL escaping (percent-encoding) converts special characters to %XX format for safe inclusion in URLs. Spaces become %20, ampersands become %26.
SQL escaping doubles single quotes and escapes backslashes to prevent SQL injection. Always use parameterized queries in production — manual escaping is a last resort.
Regex escaping prefixes metacharacters with backslashes so they match literally. Use this when building regex patterns from user input.
Related Tools
Encode URLs with the URL Encoder. Encode HTML entities with the HTML Entity Encoder. Validate JSON strings with the JSON Validator. Test regex patterns with the Regex Tester. Encode strings as Base64 with the Base64 Encoder. Convert naming conventions with the Text Case Converter. Generate URL-safe slugs with the Slug Generator.
Frequently Asked Questions
- What is string escaping?
- String escaping replaces special characters with escape sequences so they can be safely included in a specific context. For example, in JSON, a double quote inside a string becomes \", and a newline becomes \n.
- What is the difference between escape and unescape?
- Escaping converts special characters into their escaped representations (e.g., < becomes < in HTML). Unescaping reverses this, converting escape sequences back to their original characters.
- Why do I need to escape strings for SQL?
- SQL escaping prevents SQL injection attacks by ensuring that user input cannot break out of a string literal and execute arbitrary SQL commands. Single quotes are escaped as two single quotes ('').
- What does regex escaping do?
- Regex escaping adds backslashes before characters that have special meaning in regular expressions (like . * + ? ^ $ { } | [ ] \ ( )). This ensures they are treated as literal characters in the pattern.
- Is my data sent to a server?
- No. All escaping and unescaping is done entirely in your browser. No data is transmitted.
AI agent tools available.
The CodeTidy MCP Server gives Claude, Cursor, and other AI agents
access to 47 developer tools. One command: npx @codetidy/mcp