About the Escape and Unescape Text
Escape and Unescape Text converts special characters into the safe form each language expects, and back again. Pick a format (HTML, XML, JSON string, JavaScript string, URL component, full URL, CSV field, SQL string or regular expression), choose Escape or Unescape, and type or paste your text. The result updates as you type. If the text can't be decoded, for example a percent sign followed by nothing, you get a plain-language error instead of a garbled result. Escaping is specific to where the text will be used: this tool shows what each format does, but it does not make text safe for every situation.
Updated September 2026
How to use the Escape and Unescape Text
- 1Choose the format you need, such as HTML or JSON string.
- 2Pick Escape to make text safe, or Unescape to turn it back into plain text.
- 3Type or paste your text on the left. The result appears on the right.
- 4Copy the result, download it, or press Swap to send it back through the opposite direction.
What escaping is for
Programs often mix data with instructions. A quote mark can end a string, an angle bracket can start a tag and a comma can split a spreadsheet cell. Escaping marks such characters as plain data so they are not mistaken for instructions. Each language has its own rules, which is why one tool with nine formats is handy: you pick the destination, and the right rules apply.
Escaping does not make text safe everywhere. Text escaped for an HTML page is not automatically safe inside a script block or an attribute you write by hand, so follow the rules for the exact place the text will go.
HTML and XML
Both escape the ampersand, the two angle brackets and the double quote. The single quote differs: HTML mode writes ' and XML mode writes '. On the way back, numeric entities such as © and © are decoded, along with a short list of named ones. Unknown or invalid entities, including numbers past the Unicode limit, are left as they are, which avoids silently corrupting text.
Decoding runs once. Text like &lt; becomes <, not <, which matches how a browser reads it.
JSON and JavaScript strings
JSON mode escapes quotes, backslashes and control characters such as line breaks and tabs. Accented letters and emoji stay as they are. JavaScript mode also escapes single quotes and backticks, so the result fits inside any of the three JavaScript quote styles, and it writes the two odd line separator characters as \u2028 and \u2029.
Unescaping understands the usual sequences: \n, \t, \\, \xHH, \uHHHH and \u{...}. It tells you when a backslash is left dangling at the end or a hex code is incomplete.
URLs, CSV and SQL
Everything runs in your browser, so nothing you paste is sent away. Escaped text is easy to break when it is copied between systems. The URL Encoder & Decoder handles web addresses, the JSON Formatter checks that a string still fits inside a JSON file, the Regex Tester helps with backslash-heavy patterns, and the Base64 Encoder & Decoder is the better choice for binary data.
- URL component: for one query value or path piece. Spaces become %20 and & becomes %26.
- Full URL: for a whole address. It keeps : / ? # & = as they are.
- CSV field: adds quotes and doubles inner quotes only when the text has a comma, quote or line break.
- SQL string: doubles single quotes. Use parameterised queries in real code.
- Regular expression: adds a backslash before characters like . * + ? ( ) [ ] { } | ^ $. This one only goes one way.
Features
- Nine formats in one place
- Escape and unescape with live results
- Clear errors for text that can't be decoded
- Swap moves the result back to the input and flips the direction
- Handles emoji and accented letters correctly
- Copy or download the result
Frequently asked questions
What does it mean to escape a string?
Escaping replaces characters that have a special meaning in some context with a safe spelling. A double quote inside a JSON string becomes \" so it does not end the string early, and a less-than sign in HTML becomes < so it is not read as a tag. Unescaping reverses that.
How do I escape HTML special characters?
Choose HTML and Escape, then paste your text. The characters & < > " and ' are replaced with &, <, >, " and '. Paste text with entities and choose Unescape to read it as plain text again.
How do I unescape JSON?
Choose JSON string and Unescape, then paste the text without the surrounding quotes. Sequences such as \n, \" and \u00e9 become the real characters. A raw quote or a lone backslash is reported as an error, because it would not be valid inside a JSON string.
What is the difference between encodeURI and encodeURIComponent?
URL component mode (encodeURIComponent) encodes almost everything, including / ? & = and #, so it suits one value inside a query string. Full URL mode (encodeURI) leaves those characters alone so a whole address keeps working, and only encodes spaces and non-ASCII letters.
How do I escape a quote in SQL?
Choose SQL string and Escape. Every single quote is doubled, so O'Brien becomes O''Brien. This helps when you build a quick test statement by hand. For real applications use parameterised queries instead, because quote doubling alone does not protect against every kind of injection.
Why does my text show &?
The text was escaped once too often, or a program showed the raw entity instead of decoding it. Choose HTML and Unescape to turn & back into &. If you see &lt;, it was escaped twice, so unescape it twice.
Which HTML entities can it decode?
All numeric ones such as A and A, plus a small set of common named ones: amp, lt, gt, quot, apos, nbsp, copy, reg, euro, trade, hellip, mdash and ndash. Names it does not know are left exactly as written.