String Escape / Unescape
LiveEscape and unescape strings online for JSON, HTML, URLs, and regex.
Understanding String Escaping & Encoding
String escaping transforms special characters into sequences that are safe for embedding in specific contexts — JSON strings require escaping quotes and backslashes, HTML requires escaping angle brackets and ampersands, URLs require percent-encoding reserved characters, SQL requires escaping quotes to prevent injection, and XML requires escaping entity references. Each context has different rules for which characters must be escaped and what the escape sequences look like. Unescaping reverses the process, restoring the original text from its escaped representation.
Use this free online string escape and unescape tool to encode or decode strings for multiple contexts. Supports JSON backslash escaping, HTML entity encoding, URL percent encoding, and regex special character escaping. Instantly escape strings for embedding in code or unescape encoded strings back to their original form. Remove escape characters from strings with one click.
The Devkitr String Escape/Unescape tool converts text between its raw and escaped forms for JSON, HTML, XML, URL, CSV, and JavaScript string contexts. Paste raw text to get the escaped version safe for embedding in your target format, or paste escaped text to decode it back to the original readable content.
In a typical development workflow, String Escape / Unescape becomes valuable whenever you need to escape and unescape strings online for json, html, urls, and regex. Whether you are working on a personal side project, maintaining production applications for a company, or collaborating with a distributed team across time zones, having a reliable browser-based inspection tool eliminates the need to install desktop software, write one-off scripts, or send data to third-party services that may log or retain your information. Since String Escape / Unescape processes everything locally on your device, your data stays private and your workflow stays uninterrupted — open a browser tab, paste your input, get your result.
Key Features
Multi-Format Support
Escapes and unescapes for JSON, HTML entities, XML entities, URL encoding, JavaScript string literals, CSV quoting, and SQL string literals.
Bidirectional Conversion
Toggle between escape (raw → safe) and unescape (safe → raw) with the same interface, supporting round-trip verification.
Special Character Highlighting
Highlights which characters require escaping in each context — showing non-obvious characters like non-breaking spaces and zero-width joiners.
Bulk Processing
Process multi-line text with all necessary escaping applied to every line, useful for preparing database seed data or batch content insertion.
How to Use String Escape / Unescape
Paste Your Text
Enter the text containing special characters you need to escape, or paste already-escaped text you want to decode.
Select the Context
Choose the target format — JSON for API payloads, HTML for web content, URL for query parameters, SQL for database queries.
Choose Direction
Select Escape to make the text safe for embedding, or Unescape to restore the original readable content from escaped sequences.
Copy the Result
Copy the escaped/unescaped output for use in your code, templates, queries, or API requests.
Use Cases
Embedding User Content in JSON
Escape user-supplied text before including it in JSON response bodies to prevent broken JSON from unescaped quotes and backslashes.
Displaying Special Characters in HTML
Escape <, >, &, and " characters to their HTML entity equivalents before rendering user content in web pages to prevent XSS.
Decoding URL-Encoded Parameters
Unescape percent-encoded URL parameters to read the original values from browser address bars, server logs, or redirects.
Preparing SQL String Literals
Escape single quotes in text values before embedding in SQL INSERT/UPDATE statements for database seed scripts.
Pro Tips
Always escape user input before embedding in any output context (HTML, JSON, SQL, URL) — this is the primary defense against injection attacks.
When debugging garbled text, try unescaping with different formats — double-encoding or wrong-context encoding causes most text corruption.
Use parameterized queries instead of manual SQL escaping for application code — manual escaping is error-prone and insufficient against sophisticated injection.
Validate that round-trip escape→unescape produces the exact original text. If it does not, the escaping implementation has a bug for that character set.
Common Pitfalls
Escaping for the wrong context (HTML escaping for JSON, or vice versa)
Fix: Each format has its own escape rules. HTML uses & for &, JSON uses \\ for backslash, URLs use %20 for spaces. Use the correct context.
Double-escaping already escaped text
Fix: If & becomes &amp;, the text was escaped twice. Check whether your input is already escaped before applying additional escaping.
Using string escaping as a substitute for parameterized database queries
Fix: Manual SQL escaping misses edge cases. Always use prepared statements/parameterized queries for database operations — they are immune to SQL injection.
Frequently Asked Questions
QHow do I unescape a string online?
Paste your escaped string, select the encoding type (JSON, HTML, URL, or regex), and click Unescape to decode it back to the original text.
QHow do I escape a string for JSON?
Paste your text and select JSON mode. The tool adds proper backslash escaping for quotes, newlines, tabs, and other special characters.
QCan I remove escape characters from a string?
Yes. The unescape function removes escape characters and converts encoded sequences back to their original characters.
QWhich escape formats are supported?
JSON (backslash escaping), HTML (entity encoding), URL (percent encoding), and regular expression (special character escaping).
Related Articles
Related Tools
Regex Tester
Free online regex tester — test and debug regular expressions with real-time matching, highlighting, and capture group display. Alternative to RegExr.
Text Diff Checker
Free online diff checker — compare text online side-by-side and highlight every difference. Fast text compare tool and DiffChecker alternative.
Word & Character Counter
Count words, characters, sentences, paragraphs, and estimate reading time.
Case Converter
Convert text between uppercase, lowercase, title case, camelCase, snake_case, and more.