String Escaper / Unescaper
Escape or unescape strings for JSON, JavaScript, Java, XML, SQL and CSV
About this tool
Turn a multi-line string with quotes into something you can paste inside a JSON value, a JavaScript literal, a Java string, an XML text node, a SQL literal or a CSV cell — and reverse the process when you find escaped text in a log file and want to read it. Six dialects, both directions.
Each dialect follows its actual specification rather than a lowest common denominator: JSON escapes control characters as \uXXXX, JavaScript additionally escapes single quotes and backticks, Java encodes non-ASCII as UTF-16 \u sequences, SQL doubles single quotes, CSV wraps and doubles per RFC 4180, and XML uses its five predefined entities. The unescaper understands \x, \u and \u{…} forms and reports malformed sequences with their position.
Escaped strings are frequently connection strings, tokens and query fragments. This runs locally — paste freely.
Frequently asked questions
- Which dialect do I need for a JSON config file?
- JSON. It escapes double quotes, backslashes and control characters exactly as RFC 8259 requires and leaves unicode readable. The output drops into any JSON string value — without the surrounding quotes, which the tool leaves to you.
- What is the difference between the JSON and JavaScript dialects?
- JavaScript additionally escapes single quotes and backticks so the result is safe in any of the three JS quoting styles. JSON only needs double-quote handling. Unescaping accepts both, plus \x and \u{…} forms that JSON doesn't define.
- Does SQL escaping make user input safe to concatenate?
- It produces a correct SQL string literal (quotes doubled), but escaping-then-concatenating is still the wrong pattern for untrusted input — use parameterized queries. This tool is for fixtures, migrations and debugging, not injection defense.
- Why does unescaping my string fail?
- A backslash followed by something that is not a defined escape (\q, a truncated \u12) is malformed, and the error names the offending index. If your text has literal Windows paths, escape it first — C:\temp is a tab in disguise.