String Escape & Unescape Online - Free String Converter

Features

JSON escape

JavaScript escape

Java escape

Python escape

XML escape

How to Use

1. Pick the language (JSON, JavaScript, Java, Python, XML).

2. Pick Escape or Unescape.

3. Paste your string and copy the result.

About this tool

Special characters such as quotes, backslashes and line breaks have to be written as escape sequences before they can sit inside a string literal in code or data. The rules differ between languages, which is where copy-pasted text causes syntax errors and broken configs. This tool escapes or unescapes text for five targets: JSON, JavaScript, Java, Python and XML. JSON escaping follows JSON.stringify, so quotes, backslashes and control characters become \", \\, \n and \u escapes; the JavaScript, Java and Python modes handle quotes, backslashes and common control characters for their string literals; XML converts &, <, >, " and ' into entities. Paste text, pick the language and direction, and copy the result into your code.

Frequently Asked Questions

When do I need to escape a string?

Whenever text is placed inside a string literal or data format that uses some characters as syntax, for example a quote inside a JSON value, a backslash in a Windows path in JavaScript, or an ampersand inside XML.

What is the difference between JSON and JavaScript escaping?

JSON strings must use double quotes and escape control characters as \n, \t or \u00XX. JavaScript also allows single-quoted and template strings, so its escaping additionally handles single quotes and can write control characters as \x escapes.

How are line breaks represented after escaping?

A real line break becomes the two characters \n (and a carriage return becomes \r), so the whole text fits on one line of code. Unescaping turns them back into actual line breaks.

Is escaping enough to prevent injection attacks?

Escaping for the right context helps, but for SQL use parameterised queries, for HTML use your framework's templating, and for shell commands avoid building strings from user input. Manual escaping is easy to get wrong.

Why does unescaping leave some sequences unchanged?

Only sequences that are valid in the selected language are converted. If a string was escaped for a different language, for example XML entities in JSON mode, switch to the matching mode first.