// escape & unescape strings for any format
Escape and unescape strings for JavaScript, JSON, HTML, URL, CSS, and regex formats instantly. Browser-based, free, no sign-up required.
Ready to process
Select format, choose mode, then click ProcessSelect JS, JSON, HTML, URL, CSS, or Regex from the format tabs.
Pick Escape to encode special characters, or Unescape to decode them back.
Paste your string, click Process, then copy the result with one click.
String escaping converts special characters into safe representations for a given context — preventing syntax errors, injection attacks, and encoding bugs. This tool handles six common formats used in web development every day.
String escaping is the process of converting special characters into sequences that are safe within a particular context — for example, turning a double-quote " into \" in JavaScript so it doesn't break a string literal.
JavaScript string escaping uses backslash sequences and handles a wider range of control characters. JSON escaping is a strict subset — it only allows specific escape sequences defined in the JSON spec, such as \n, \t, \", and \\.
Use URL encoding (also called percent-encoding) whenever you embed arbitrary text into a URL — in query parameters, path segments, or form submissions. Characters like spaces, &, and = have special meaning in URLs and must be encoded to avoid breaking the structure.
HTML escaping converts characters like <, >, and & into their entity equivalents so browsers render them as literal text rather than markup. This is critical for preventing cross-site scripting (XSS) attacks when displaying user-supplied content.
CSS escaping converts characters that have special meaning in CSS selectors or content values into their Unicode escape form (\XXXXXX). This is useful when dynamically building CSS selectors from user data that may contain spaces, dots, or brackets.
No. All processing happens entirely in your browser via JavaScript. Your strings are never transmitted to any server, ensuring complete privacy for sensitive content like credentials, API keys, or personal data.
Whether you're embedding text in a JavaScript string, building a URL query parameter, inserting HTML content dynamically, or writing a regular expression pattern, correct string escaping is fundamental to writing safe, bug-free code. This free, browser-based tool handles the six most common escaping formats used in modern web development — instantly, privately, and without requiring any account or installation.
Special characters carry meaning in every language and format. A double-quote inside a JavaScript string literal breaks the syntax. An ampersand inside HTML text gets misinterpreted as the start of an entity. A question mark inside a URL query value confuses the parser. Without proper escaping, these characters cause bugs ranging from minor display glitches to critical security vulnerabilities like SQL injection or cross-site scripting (XSS).
String unescaping is the reverse — converting encoded representations back into their original form. This is equally important when reading data from APIs, log files, databases, or configuration files that store escaped strings.
JavaScript string escaping handles the backslash sequences defined in the ECMAScript specification. Characters like newlines (\n), carriage returns (\r), tabs (\t), backslashes (\\), and quote characters (\", \') are all escaped with a preceding backslash. Null bytes and other control characters in the range \x00–\x1f are also escaped to prevent injection into script contexts. Use this format when building dynamic JavaScript code, template literals, or embedding text in JSON-free JS configurations.
JSON escaping follows the strict rules defined in RFC 8259. Only specific sequences are valid: \", \\, \/, \b, \f, \n, \r, \t, and \uXXXX for Unicode code points. This tool produces output that is valid inside a JSON string value — useful for constructing JSON payloads manually, debugging REST API requests, or preparing data for storage in JSON-based databases.
HTML entity escaping converts the five characters that have special significance in HTML markup: & becomes &, < becomes <, > becomes >, " becomes ", and ' becomes '. This is essential whenever you're rendering user-generated content, dynamic text, or data from external sources inside an HTML page. Failing to escape HTML properly is one of the most common causes of XSS vulnerabilities in web applications.
HTML unescaping reverses this process — converting entity references like é or é back to their original characters. This is useful when parsing HTML, working with CMS-generated content, or processing data scraped from web pages.
URL encoding, formally known as percent-encoding, replaces characters that are not allowed or have reserved meaning in URLs with a percent sign followed by two hexadecimal digits representing the character's byte value. Spaces become %20, the plus sign becomes %2B, slashes become %2F, and so on. This tool uses rawurlencode semantics, which encodes all characters except unreserved ones — compliant with RFC 3986. Use URL encoding for query parameters, path segments, form data, and any string that will become part of a URL.
CSS escaping converts non-alphanumeric characters into their Unicode escape form (\XXXXXX) as defined in the CSS Syntax specification. This is particularly useful when building CSS selectors programmatically — for instance, if you need to target an element whose ID contains dots, spaces, or hash symbols. The CSS escape format ensures these characters are treated as literal parts of identifiers rather than selector syntax.
Regular expressions use many metacharacters — ., *, +, ?, (, ), [, ], {, }, ^, $, |, \ — to define patterns. When you want to match one of these characters literally, it must be escaped with a backslash. This tool uses PHP's preg_quote() to escape all regex metacharacters, producing a safe pattern fragment you can embed in any regex.
All conversions in this tool happen entirely inside your browser using JavaScript. No data is sent to any server at any point. This means you can safely paste sensitive strings — API keys, passwords, private messages, confidential data — without any risk of interception or logging. The tool works offline once the page is loaded.
<script> tag needs JavaScript escaping; one in a <p> tag needs HTML escaping.rawurlencode) encodes spaces as %20; form encoding (urlencode) encodes them as +. This tool uses raw URL encoding (RFC 3986 compliant).