One tool for seven kinds of escaping
A quote inside a string, a backslash in a Windows path, a dot in a regular expression: each needs a different treatment depending on where the text ends up. This page escapes text for the inside of a JSON or JavaScript string, a SQL literal, a regular expression, a CSV field, a POSIX shell command or a run of \u sequences, and reverses every one of them.
Escape or unescape in four steps
- Choose the format that matches where the text will be used.
- Pick Escape to make plain text safe, or Unescape to turn an escaped string back into text.
- Type or paste the text. The result updates as you type, and an error explains what is wrong with an invalid escape.
- Press Copy, or use the result as the next input to check that it round-trips.
What each format does
- JSON:
\",\\,\n,\tand\uXXXXfor control characters. The result goes between the quotes. - JavaScript: the same plus
\'and the backtick, so it fits any string style, with\xHHand\u{…}read back. - SQL: a single quote becomes two, as in
O''Brien. Prefer parameters over building queries from strings. - Regex: a backslash before
. * + ? ^ $ { } ( ) | [ ] \, so the text matches itself. - CSV: quotes doubled and the field wrapped in quotes when it contains a comma, quote or line break.
- Shell: single quotes with
'\''for an apostrophe. Unescaping also reads$'…'strings. - Unicode: every character outside ASCII as
\uXXXX, with emoji as surrogate pairs.
Escaping is not security
Escaping a string for one language does not make it safe for another. Text placed in HTML needs HTML escaping, in a URL it needs percent-encoding, and a database query needs parameters. Use the right tool for the place where the text ends up, and treat this page as a way to prepare and read strings, not as protection against injection.
Nothing is sent anywhere
The conversion runs in your browser, so tokens, queries and paths you paste stay on your device.