JSON Escape Unescape

Turn plain text into one JSON string literal, or decode one quoted JSON string back to its text value without changing the value into another JSON type.

Escape starts with ordinary text and produces a quoted JSON string literal. Unescape starts with one complete quoted JSON string such as "hello\\nworld". Objects and arrays are a different job.

Input0 characters

Result

Escaped or unescaped text will appear here...

JSON escaping is not sanitization

Serialization and parsing happen in the browser with JSON.stringify() and JSON.parse(). A valid JSON string can still contain HTML, SQL, shell text, secrets, or another nested data format. Encode or validate again for the destination context rather than treating the JSON layer as a security boundary.

A JSON string is a value, not just text with backslashes

JSON strings begin and end with double quotation marks. Inside those quotes, the quotation mark itself, the backslash, and control characters from U+0000 through U+001F need escape syntax. Newline and tab have short forms such as \\n and \\t; any 16-bit code unit can also be written with \\uXXXX syntax.

Escaping plain text therefore includes the outer quotation marks. That is important when the result is going into a JSON property. Removing the quotes afterward does not produce the same JSON value; it produces a fragment of text whose meaning depends on another layer.

Quotes, paths, and nested JSON show three different layers

A quote and a newline

Plain text:
Sneha said "hello".
Next line

JSON string literal:
"Sneha said \"hello\".\nNext line"

A Windows path

Plain text: C:\temp\file.txt
JSON string literal: "C:\\temp\\file.txt"

JSON stored as a string

Original JSON object text:
{"name":"Sneha"}

The same characters stored as one JSON string value:
"{\"name\":\"Sneha\"}"

An object and a string containing an object are different data

{"name":"Sneha"} is a JSON object. If those characters are escaped as plain text, the result is a JSON string whose value happens to look like object syntax. The receiver must parse another JSON layer if it genuinely expects nested JSON text.

Unescape deliberately rejects objects, arrays, numbers, booleans, and null. That keeps a string-decoding operation from quietly turning into a general JSON parser. For complete documents, validation and formatting belong at the document level instead.

Double escaping may be a bug or a real second serialization layer

A newline represented by \\n becomes \\\\nwhen that already-escaped text is serialized again. Sometimes that is exactly what a nested message, log envelope, or database field requires. Sometimes it means the same value was escaped twice by accident.

The characters alone cannot tell you which case you have. Follow the data across each serialization boundary and count how many times a JSON parser will run before the final string is consumed.

Unicode normally stays readable, but lone surrogates deserve attention

Ordinary Unicode characters do not need to be converted to\\uXXXX. A JSON text exchanged between systems is normally encoded as UTF-8, so text such as पुणे 😀 can remain visible in the serialized string.

JavaScript strings are sequences of UTF-16 code units, which means they can contain an isolated high or low surrogate. Modern JSON.stringify() serializes lone surrogates with escape syntax so the JSON text remains well formed. RFC 8259 nevertheless warns that strings containing unpaired surrogates can behave unpredictably across implementations, so a notice appears when one is detected.

JSON permits more than JavaScript source and less than many config files

JSON strings use double quotes; single-quoted JavaScript strings are not JSON strings.
Unknown escapes such as \\x41 are not JSON string escapes, even though JavaScript source has additional escape forms.
A solidus may appear as / or \\/; escaping it is optional in JSON.
Comments and trailing commas belong to other formats or extensions, not standard JSON.
U+2028 and U+2029 are valid JSON string characters; embedding JSON into another language or HTML context can add separate requirements.

The grammar comes from JSON, while the behavior here comes from JavaScript

RFC 8259 defines interoperable JSON syntax and UTF-8 expectations, including the warning about unpaired surrogates. The concise syntax definition is also published as ECMA-404. The actual escape and unescape operations on this page follow the browser's ECMAScript JSON.stringify() and JSON.parse() implementations.

What the JSON layer cannot decide

Whether a nested JSON-looking string was intentionally serialized twice.
Whether a string is safe for HTML, a URL, SQL, a shell, XML, or a filesystem path.
Whether an object follows a schema or an application's business rules.
Whether a secret should have been present in the copied text in the first place.