JSON Escape & Unescape Online - Free String Tool
Escape and unescape strings for JSON format. Handle special characters for API development and data exchange
JSON Escape: Safe Strings for JSON Without Manual Backslash Counting
JSON strings carry payloads that conflict with JSON's own syntax. A database record contains double quotes inside a text field. An API response includes a literal backslash that happens to precede a letter used in an escape sequence. A user-generated content field has real newline characters that must survive a round-trip through JSON serialization. A URL query string contains characters that JSON parsers interpret as string terminators or control sequences.
Getting escaping right by hand is unforgiving. Forget one backslash before a double quote, and the entire JSON document becomes unparseable and the error message points nowhere near the actual problem. Double-escape a backslash — two consecutive backslash characters where one is needed — and the decoded string contains a literal backslash where the original data had none, corrupting paths, URLs, and regex patterns silently. The margin for error is exactly one character, and the feedback loop requires re-parsing the entire document to discover any mistake.
This tool automates JSON string escaping and unescaping. Paste a raw string — any string, from any source — and it produces the correctly escaped version ready for embedding inside a JSON document. Paste an already-escaped JSON string, and it decodes it back to the original raw text. A single toggle switches between both directions. Everything runs in your browser.
Privacy & Security Guarantee
No data leaves your browser. All JSON processing happens locally using JavaScript. This means you can safely work with sensitive information like API keys, authentication tokens, customer data, and proprietary configurations. There is no server-side processing—we don't even have servers that could store your data.
What is JSON Escape? - Understanding JSON String Escaping
Escape
Convert a regular string into JSON-safe format.
Example:
Input: Hello "World"
Output: Hello \"World\"
Unescape
Restore escaped JSON strings to original content.
Example:
Input: Hello \"World\"\nNew Line
Output: Hello "World"
New Line
Use Cases
API Development: Convert user input with special characters to JSON-safe format
Data Storage: Safely store strings in JSON
Configuration: Handle config files with special characters
FAQ
Which characters need escaping?
Special characters that need escaping in JSON:
"Double quote →\"\Backslash →\\\nNewline →\\n\tTab →\\t\rCarriage return →\\r
When is JSON escaping used?
Main use cases:
- API Requests: Safely include user input with special characters in JSON body
- Logging: Serialize log messages with special characters to JSON format
- Data Import: Process CSV or text data with quotes and newlines
- Frontend Development: Generate dynamic JSON config files
What's the difference between escaping and encoding?
JSON escaping (e.g., " → \") is required by JSON format specification.
URL encoding (e.g., " → %22) is for URL parameter passing.
They serve different purposes. Use JSON escaping for JSON strings; use URL encoding for URL parameters.
Common Use Cases
Escape JSON strings
Prepare text for use in JSON payloads
Handle user input
Safely embed user content in JSON
API request preparation
Escape special characters for APIs
The escape mode processes a raw string into its JSON-safe representation. Every character that has special meaning inside JSON strings is replaced with the correct escape sequence: double quotes become backslash-quote, backslashes become double-backslash, newlines become backslash-n, tabs become backslash-t, carriage returns become backslash-r, form feeds become backslash-f, and backspaces become backslash-b. Characters outside the printable ASCII range are encoded as Unicode escape sequences so they survive transmission through systems that do not handle full Unicode gracefully.
The unescape mode reverses this process. It takes a JSON-escaped string — the kind you would find as a value inside a .json file or a JSON API response — and converts every recognized escape sequence back to its original character. A backslash-n becomes an actual newline, a backslash-t becomes a tab character. The output is the exact raw string that was originally encoded.
Use the converter direction toggle at the top to switch between escape and unescape modes. The tool handles both single-line and multi-line inputs, and correctly processes Unicode escape sequences regardless of which direction you are converting.
The escape and unescape operations are exact inverses of each other. If you start with a raw string, escape it, wait six months, and then unescape it — you get back exactly the original string, character for character. This round-trip fidelity is critical for workflows where escaped JSON strings are stored in databases, passed through message queues, or embedded in configuration files that are read and written by different systems at different times. There is no silent data loss from ambiguous escape sequences or encoding drift.
Real-World Scenarios
Embedding user content in JSON APIs. A frontend developer has a text area where users can type anything — product descriptions, support messages, profile bios — and this content must be embedded as a string value inside a JSON API payload. The raw text might contain unescaped double quotes from copied-and-pasted content, line breaks from multi-paragraph entries, or backslashes in Windows file paths. The developer pastes the raw text into the escape tool, gets the properly escaped string, and inserts it directly into the JSON payload without worrying about syntax corruption.
Debugging encoded API responses. A backend developer receives a bug report about garbled text in an API response. The JSON looks valid but the string values contain sequences like double-backslash-n that display as literal backslash-n instead of newlines. They copy the suspicious string value into the unescape tool to see what it actually decodes to — revealing whether the data was double-escaped somewhere in the pipeline or whether the escaping is correct and the display layer has a separate issue.
Configuration file authoring. A DevOps engineer is writing a JSON configuration file that includes file paths, regex patterns, and SQL connection strings — all of which contain backslashes and double quotes that need escaping. Rather than manually counting backslashes and verifying with a JSON validator after every edit, they write the raw strings, escape them in one pass, and paste the result into the configuration file.
Edge Cases Handled Automatically
Solidus escaping — the forward slash can optionally be escaped as backslash-slash in JSON to prevent script tag injection when JSON is embedded in HTML. The unescape mode correctly decodes this back to a forward slash regardless of whether the original encoder chose to escape it.
Unicode surrogate pairs — characters outside the Basic Multilingual Plane like emoji, historical scripts, and rare CJK characters — are encoded as UTF-16 surrogate pairs in the JSON specification format. The tool handles these correctly in both directions, ensuring characters like emoji round-trip through escape and unescape without corruption.
The tool does not validate the structural correctness of an entire JSON document. It operates on raw strings and escaped strings, not on JSON objects or arrays. If you have a full JSON document that contains unescaped characters, use the JSON validator tool first, identify the problematic string value, extract it, escape it here, and re-insert it into the document.
Common situations where escaping is necessary: embedding a Windows file path like C:\Users\name\doc.txt in a JSON config file (the backslashes must be escaped); storing user-submitted text that contains quotation marks inside a JSON database column; passing a multi-line string through a REST API that only accepts single-line JSON values. In each case, the raw string is perfectly valid in its original context — it only becomes problematic when placed between JSON string delimiters.
Privacy
Every operation — character-by-character escape sequence generation and decoding, Unicode surrogate pair handling, and solidus processing — runs entirely in your browser using JavaScript string manipulation. Your strings, including API keys, database connection strings, and user-generated content that may contain personally identifiable information, never leave your device.