Unicode Escape/Unescape

Every character has a code point — a number set by the Unicode standard, so an e-acute is U+00E9 and the rocket is U+1F680. An escape sequence writes that number using characters that are safe everywhere: a backslash, a u, and four hexadecimal digits. Four digits is both the design and the limit, since the notation dates from when Unicode was thought to fit in 65,536 slots, so anything past U+FFFF has to be written as a pair. An escape is a spelling of a character, not a different character: once the source is parsed, the two are the same string.

JSON is defined over Unicode and UTF-8 is its default encoding, so an accented letter, a CJK character or an emoji can sit directly in a string and every current parser reads it. Escapes are permitted rather than required, and most writers emit them only where the grammar forces it: the double quotation mark, the backslash, and control characters below U+0020. What pushes people to escape anyway is usually a pipeline that mangles the file between writing and reading — a shell heredoc, a build step, a system that assumes Latin-1 — and an escaped payload survives all of them unchanged.

Because the four-digit form addresses a 16-bit unit rather than a character. Anything above U+FFFF — emoji, many historic scripts, the CJK extensions — is held in UTF-16 as a surrogate pair: two units in the D800 to DBFF and DC00 to DFFF ranges that mean nothing on their own. U+1F680 becomes \ud83d followed by \ude80, and the halves have to travel together. A system that truncates by counting units and cuts between them leaves a lone surrogate, which is why a replacement symbol turns up at the end of a trimmed message. Newer JavaScript accepts the braced form \u{1f680} as one escape instead.

Before Java 9, a file loaded through Properties.load was read as ISO-8859-1, so anything outside that set had to be written as an escape, and the JDK shipped a native2ascii tool to convert files wholesale. From Java 9 onwards, resource bundles are read as UTF-8, falling back to ISO-8859-1 only when the bytes are not valid UTF-8, so plain accented text works. Escapes are still honoured either way, so they remain the safer choice when you do not control the runtime. The loader is what expands them: the file on disk holds a backslash, a u and four digits, not the character.

That is mojibake, and escaping it now freezes the damage. The two UTF-8 bytes of the accented letter have been read back as two separate Latin-1 characters, so escaping produces a faithful record of the wrong characters. The repair belongs where the misreading happened — a file opened without naming an encoding, a database column or connection on the wrong character set, an HTTP response missing charset=utf-8. Work backwards to the first place the text looks wrong and correct it there. Escaping is for text that is already right and has to cross something that cannot carry it.

The conversion happens inside the page. Escaping reads your text with charCodeAt, unescaping is a single regular expression feeding String.fromCodePoint, and neither path evaluates what you paste as code, so a fragment of script stays inert data. No request carries the text anywhere. What you typed lives in an ordinary React state variable until you close or reload the tab — no history, nothing in local storage, nothing in the address bar. That matters here because the strings people escape are so often lifted out of a file with a credential two lines above.

They are the same idea in different formats. The \u form with exactly four hex digits is what Java, JSON, C# and JavaScript use. The \x form takes two digits and stops at 255, covering Latin-1 and nothing beyond; C, Python and JavaScript accept it. Python adds an eight-digit variant for the whole range, plus a form that names a character outright. Octal is inherited from C and best avoided in new code. The ampersand-hash references are HTML and XML, closed by a semicolon rather than fixed in width, and belong in markup, not source.

A line break inside a string literal is the usual reason people reach for escaping, and precision helps here. Most languages want the \n and \t shorthands — short, readable, understood everywhere — rather than the four-digit forms, which mean the same to a compiler but not always to a parser someone wrote by hand. Escaping ordinary printable ASCII is rarely necessary and makes the result hard to read. The exceptions are the characters a format reserves, such as a quotation mark inside a quoted string, and characters that are invisible.