Skip to content
Allin
Sign up · Sign in

JSON String Escape / Unescape

Turn raw text into a JSON-safe string and back, with control characters, \uXXXX, emoji surrogate pairs and lone surrogates handled exactly like JSON.stringify.

Related tools

All Encoding & decoding tools →
String escape / unescapeEscape a string for JSON/JavaScript or unescape it back to raw text.Unicode escape / unescapeEscape non-ASCII characters to \uXXXX sequences, or decode them back.JSON to query stringTurn a flat JSON object into a URL query string.Query string to JSONParse a URL query string into JSON and build one back. Repeated keys become an array, tag[]= and filtre[prix]= expand into arrays and objects, + is a space and %C3%A9 is é.Query String BuilderBuild a URL query string from key/value rows with correct percent-encoding, array syntax options and a UTM preset — or parse an existing URL back into rows.HTML Entity Encoder / DecoderConvert text to HTML entities and back, escaping <, >, &, quotes and optionally all non-ASCII characters.UUID Validator / DecoderValidate UUIDs and decode their version, variant, and the timestamp and MAC a v1 carries.JSON Schema generatorTurn a sample of JSON into a JSON Schema. Paste an object, an array or newline-delimited records and it infers the types, properties and array shapes, merges the fields seen across objects into a required list, and recognises common string formats — email, URL, UUID, date and date-time — across Draft 2020-12, 2019-09 or Draft-07.

Open JSON String Escape / Unescape and you get an answer straight away, with no account to create. You will find it under Encoding & decoding, with String escape / unescape and Unicode escape / unescape for the neighbouring cases.

How to use it

  1. Open the tool — no signup or install needed.
  2. Enter your input or adjust the available options.
  3. Get your result instantly, then copy or download it.

Frequently asked questions

What does JSON String Escape / Unescape do?

Turn raw text into a JSON-safe string and back, with control characters, \uXXXX, emoji surrogate pairs and lone surrogates handled exactly like JSON.stringify.

When would I actually use this?

Reading a payload someone sent you, embedding a small file in a config, and finding out why a query string breaks once it reaches the server.

What is the most common mistake?

Treating Base64 as a form of protection. It is an encoding, not encryption — anyone can decode it instantly, and a token pasted into a public issue is a leaked token.

How is JSON String Escape / Unescape different from String escape / unescape?

They sit next to each other but answer different questions: String escape / unescape is the one to open when you need it to escape a string for JSON/JavaScript or unescape it back to raw text. Pick whichever matches what you're starting from — both are free.

Is there a tool for the next step?

Unicode escape / unescape is the closest one after this: Escape non-ASCII characters to \uXXXX sequences, or decode them back.

What else is worth having open alongside it?

JSON to query string and Query string to JSON — they come up in the same task often enough to be worth a second tab.

Where do the figures come from?

The encodings follow their RFCs, so a round trip is lossless. URL encoding has two variants — one that encodes a space as %20 and one as a plus sign — and the tool says which it applies.

Further reading

All guides →
ExplainerEscaping a String for JSON: Three Characters Are Mandatory, and One Is a TrapRFC 8259 requires exactly three things to be escaped inside a JSON string. Everything else is optional. The one that actually breaks pipelines is a lone surrogate — legal in JSON text, impossible in UTF-8, and silently replaced the moment your data is written out.GuideBuilding a URL With Parameters That Survives a Copy-PasteThree encodings, one visible difference: %20 or +. The builder's form mode matches URLSearchParams byte for byte on seventeen values — but give it a base URL with a fragment and every parameter lands inside the hash, where no server sees it.GuideURL Encoding Explained: Percent-Encoding and Where It BitesPercent-encoding is decided per URL component, which is the whole source of the confusion. A slash is legal in a path and must be escaped in a query value; a space is %20 in a path and may be + in a form body. Here are the exact RFC 3986 sets, the three JavaScript functions that disagree, and the traps.ExplainerJSON Is Simpler Than You Think, and That Is the ProblemJSON has no integer type, no date type, no comments and no schema. Every one of those absences produces a specific bug: a 19-digit ID comes back off by 21, a timestamp becomes a string nobody agreed on, NaN cannot be written down, and duplicate keys are legal. All of it run, in two languages.ExplainerYAML Looks Friendly and BitesYAML is JSON plus a type-inference layer, and the inference is the dangerous part. The same file run through a YAML 1.2 parser and a YAML 1.1 parser: no is a string in one and false in the other, 01234 is 1234 in one and 668 in the other, and 12:30:00 is a number in one of them.GuideStripping HTML Safely: What a Tag Remover Can and Cannot DoRemoving tags and sanitising HTML are two different jobs. One real fragment run through a naive regex and through a formatting-aware stripper, with script and style contents, block breaks, comments, CDATA and entity order all shown as output.