Text Escape and Unescape

Escape text for code, markup and data

Escaping writes characters that have a meaning in a format, like a quote inside a string or a < in HTML, in a form the parser reads as plain text. Unescaping turns the escaped form back into the original text. This tool does both for nine formats, live as you type. The URL encoder and the HTML entity converter go deeper on their one format; this page is for switching between formats quickly.

The formats explained

• JSON. RFC 8259 says the quotation mark, the backslash and the control characters U+0000 to U+001F must be escaped. A character outside the Basic Multilingual Plane is written as a 12-character surrogate pair, like \uD834\uDD1E. Unescape accepts exactly the escapes the RFC lists.
• JavaScript. MDN notes that every code point may appear in a string literal except the backslash, CR, LF and the quote that opens the string. The tool escapes those, the chosen quote only, and other control characters. In template mode it also escapes ${ so the text never starts a substitution. Unescape also reads \xHH, \u{...}, line continuations and identity escapes like \z, which MDN describes as the character itself.
• HTML and XML. Escape writes the five special characters as references; with Escape non-ASCII on, every other character above U+007F becomes a decimal reference like &#233;. HTML unescape knows all named references of the HTML standard and reads them the way a browser does. XML predefines only amp, lt, gt, apos and quot, and the XML spec allows a reference only to characters that XML permits, so &nbsp; or &#1; is an error there.
• URL. Component uses encodeURIComponent, which MDN says leaves only A to Z, a to z, 0 to 9 and - _ . ! ~ * ' ( ) as they are. Full URI uses encodeURI, which also keeps ; / ? : @ & = + $ , and #. MDN notes that RFC 3986 reserves ! ' ( ) and *, so the RFC 3986 option escapes them too. Space as + follows application/x-www-form-urlencoded, where MDN says spaces become +.
• CSV. RFC 4180 says fields with line breaks, double quotes or commas should be enclosed in double quotes, and a quote inside such a field is escaped by another quote. A field without quotes may not contain a quote. The whole input is treated as one field.
• Regex. MDN lists ^ $ \ . * + ? ( ) [ ] { } | and / as the syntax characters that need a backslash outside a character class. Like RegExp.escape follows the newer built-in, which MDN marks Baseline 2025: it also escapes a leading letter or digit, spaces, and punctuation like - or = as \x escapes. MDN explains that a backslash before such punctuation is a syntax error with the u flag.
• SQL. PostgreSQL's docs say to include a single quote in a string constant, write two adjacent single quotes. MySQL accepts that too, but also treats the backslash as an escape character unless the NO_BACKSLASH_ESCAPES mode is on; turn on Backslash escapes for MySQL.

SQL escaping is not injection protection

The OWASP SQL Injection Prevention Cheat Sheet names prepared statements with parameterized queries as the primary defense and calls escaping all user input strongly discouraged, partly because escaping depends on the SQL dialect and its configuration. Use the SQL mode for hand-written queries, seed data or one-off scripts, never to make user input safe in an application.

Errors when unescaping

The tool checks the rules instead of guessing. A \q in JSON, a lone & in XML, a % without two hex digits in a URL, bytes that are not valid UTF-8, an undoubled quote in a CSV field or a lone quote in an SQL string all stop with a message, the line and column, and a Jump to error button. If the input starts and ends with the quote of the format, such as "text" in JSON, the quotes are removed first. HTML stays lenient like a browser: unknown names are kept and listed as a note.

A worked example

A product name reads Café "Rouge" & Bar, and it has to go into several places. As a JSON value it becomes Café \"Rouge\" & Bar. In HTML it becomes Café &quot;Rouge&quot; &amp; Bar. As a query value with Component, it becomes Caf%C3%A9%20%22Rouge%22%20%26%20Bar. In a CSV file it needs quotes: "Café ""Rouge"" & Bar". Press Use result as input to check any of them: the tool switches to Unescape and gives back the original name.

Limits

• Files up to 5 MB can be opened and are read as UTF-8 text. The preview shows the first 200,000 characters; Copy and Download include everything.
• A lone surrogate, half of an emoji, is not a valid character. JSON, JavaScript and regex escape it as \uD800 style escapes; URL encoding cannot represent it and reports an error. Copy and Download turn a lone surrogate in the result into U+FFFD.
• Regex unescape works only for patterns that stand for one fixed text. Classes like \d and operators like * cannot be turned back into text.

How to use the text escape tool

1. 1Choose Escape or Unescape and the format.
2. 2Paste your text, drop a file or open one, and set the options for the format.
3. 3If an error appears, jump to it and fix the input.
4. 4Copy the result or download it as a .txt file.

Sources

• RFC 8259: The JSON Data Interchange Format, section 7 Strings
• MDN: Lexical grammar, string literals and escape sequences
• MDN: Character reference
• W3C: XML 1.0, Fifth Edition (sections 2.2 Characters, 2.4 Character data and 4.1 Character references)
• MDN: encodeURIComponent() and encodeURI()
• RFC 3986: URI Generic Syntax, section 2 Characters
• RFC 4180: Common Format for CSV Files, section 2
• MDN: Character escape and RegExp.escape()
• PostgreSQL: Lexical structure, string constants and MySQL 8.4: String literals
• OWASP: SQL Injection Prevention Cheat Sheet

Related guides

• Hashing vs Encryption vs Encoding: What Each One Does
• UTF-8 and Unicode Explained: Code Points, Bytes and Mojibake
• CORS Explained: Why the Browser Blocks Your Request

Built by Tobias. Updated October 30, 2026.

Frequently asked questions