JSON String Escape
Escape text to one JSON string or strictly decode it, preserving embedded text and numeric IDs.
This tool runs entirely in your browser. Your data is never uploaded, never stored, and never leaves your device.
Escape plain text into a complete JSON string or strictly decode one quoted string without parsing its embedded content.
How to use it
- 1Choose Escape text or Decode quoted JSON string and supply the corresponding source.
- 2Optionally choose ASCII-only escaped output, then run one explicit conversion.
- 3Inspect quotes, controls and code points; copy or download the complete result.
Example
- Input
- A\B "C"
- Output
- "A\\B\n\"C\""
A real newline is encoded differently from the literal characters backslash and n.
What happens to your data
No source is uploaded, stored, placed in a URL or evaluated. File BOM is consumed as an encoding marker. Lone surrogates are refused, and JSON escaping alone is not safe embedding into HTML or script elements.
Last updated October 2026
A quoted message, Windows path or multi-line block of text cannot simply be pasted between JSON quotes. Quotes, backslashes and control characters need the correct JSON escapes. This tool turns plain text into one complete JSON string literal with its outer double quotes, or decodes one quoted JSON string back to text. The operation is explicit, so it does not guess whether a backslash was data or another encoding layer.
The content inside that string is not parsed as a JSON document. A copied response containing a long numeric ID, unusual spacing or repeated object keys stays text. Use the separate JSON Formatter to inspect an actual object or array. Here the job is adding or removing exactly one string-escaping layer without quietly converting the embedded data into JavaScript numbers.
How it works
Escape text generates a complete quoted JSON string. A double quote becomes an escaped quote, a backslash becomes a doubled backslash, and controls use JSON's supported escapes. A real newline becomes backslash-n; the two literal characters backslash and n become a doubled backslash followed by n. That distinction matters for file paths and copied log payloads. Empty text generates the valid JSON string made of two double quotes.
ASCII-only output is optional. It writes non-ASCII UTF-16 units as four-digit Unicode escapes, with a supplementary character such as an emoji represented by its valid high/low surrogate pair. DEL is escaped too for visibility. Without that option, ordinary Unicode text can remain readable inside the JSON string. Escaping a character does not change its decoded value. Forward slashes are not escaped because JSON permits them directly. The result includes both outer quotes; do not wrap it in a second pair when inserting it as a JSON value.
Decode requires exactly one complete double-quoted JSON string. Only JSON whitespace—space, tab, CR and LF—is accepted around it. Objects, arrays, numbers, booleans, null, single-quoted strings and bare backslash sequences are refused rather than coerced into text. JSON does not accept JavaScript's hexadecimal escape or braced Unicode escape syntax. Invalid escapes, unescaped line breaks and malformed quoting stop export. The page does not use eval or execute the source.
Decoded lone Unicode surrogates are refused deliberately. JSON's grammar can represent them, but RFC 8259 warns that behavior with non-Unicode sequences is unpredictable across implementations. A complete surrogate pair is accepted and yields its Unicode character. Decoded controls such as a newline or NUL remain actual text characters; a visible warning and code-point preview help inspect them, and the downloaded text retains their bytes. Successful string decoding does not make those bytes appropriate for every receiving application.
Load one UTF-8 file or paste text. Source is bounded to 1 MiB and generated output to 4 MiB. ASCII escaping can expand the output enough to reach that limit; no partial file is offered. File import strictly rejects malformed UTF-8, UTF-16/32 BOMs, NUL and selected raw controls as outside the plain-text-file subset. A leading UTF-8 file BOM is consumed as an encoding marker, not included as string content. An escaped control in a valid JSON string is different from a raw control byte in an imported text file.
Loaded original text stays separate from its read-only preview, preserving original CR/LF text for the transformation. Pasted text has browser-normalized line endings. The result preview shows at most 12,000 characters; copy and download keep the full accepted result. Text boxes and clipboards can alter line-ending representation, so use the UTF-8 download when exact decoded bytes matter. Changing the operation, ASCII option or input invalidates the old result, and late file reads cannot overwrite a newer edit.
String escaping is not a general injection-defense function. A JSON string containing a closing script tag can still be dangerous when concatenated into HTML or a script element. Use context-appropriate serialization and output handling in your application. This widget renders content as text, uploads no source and stores no input in browser storage. Page assets and anonymous usage events can use the network, without including the string. Review exported files before sharing or opening them elsewhere.
Worked example: Keep a literal backslash separate from a real newline
- Input
- A\B "C"
- Result
- "A\\B\n\"C\""
The generated value includes outer quotes. Decoding once restores A, one backslash, B, a newline and the quoted C. Embedded JSON objects are not parsed.
Common use cases
- Put a multi-line message into a JSON string value
- Inspect one escaped string copied from an API or log
- Represent Windows paths without accidentally interpreting backslash-n as a newline
- Decode a string carrying JSON-looking text while preserving its numeric spellings
Frequently asked questions
Does the escaped output include the double quotes?＋
Yes. It is one complete JSON string literal, not just its interior. Insert it as a JSON value without adding another pair of quotes. Escape text also accepts an empty string and returns two double quotes.
Why does JSON unescape reject an object, array or bare escape sequence?＋
This operation removes one JSON string layer. Supply a complete double-quoted string. It does not guess a missing wrapper, evaluate JavaScript or convert arbitrary JSON values into text.
What is the difference between a newline and the characters backslash-n?＋
A real newline is encoded as backslash-n. A literal backslash is itself escaped, so literal backslash-n becomes a doubled backslash followed by n. Decode exactly once to reverse that one escaping layer.
Will IDs such as 9007199254740993 be rounded?＋
Not when they are content inside the supplied string. Embedded text is not parsed as an object or number, so its digits and spacing are retained. A different program can still round the value if it subsequently parses that decoded text as JSON.
Why are lone surrogate escapes rejected?＋
They do not form complete Unicode characters and can behave inconsistently between implementations. A valid paired escape is accepted. This is a deliberate interoperability guard rather than a claim that RFC 8259's grammar excludes every lone surrogate spelling.
Is JSON escaping safe for an HTML page, script tag or SQL query?＋
Not by itself. Different output contexts have different rules. This tool creates JSON string syntax only; use the receiving framework's context-appropriate handling instead of concatenating its result into HTML, scripts or queries.
Can I decode several layers automatically?＋
No. Each operation handles one explicit layer. Repeated decoding can change literal backslashes into controls unexpectedly. Inspect the result and choose another operation only when another layer is genuinely intended.
Related tools
JSON Formatter & Validator
Format, validate, and minify JSON with exact line errors, a searchable tree, and private processing.
Unicode Escape/Unescape
Turn text into \uXXXX sequences and back; by default only non-ASCII goes, or tick Escape everything.
Unicode Normalizer
Normalize Unicode locally with code-point comparisons and clear NFC, NFD, NFKC and NFKD choices.
Text Encoding Converter
Decode supported text encodings and save UTF-8 or UTF-16 with strict byte checks and BOM options.