String Escape and Unescape

JSON, JavaScript, HTML, URL, shell and regular expressions. Each uses the rules for its context, such as doubling backslashes for JSON, entity encoding for HTML, percent encoding for URLs and single-quote wrapping for the shell.

Newline, carriage return, tab, backspace and form feed become the short escapes \n, \r, \t, \b and \f. Any other control character below code point 32 is written as a \uXXXX sequence, so the result is a safe string literal with no literal control bytes.

It is the contents of a string literal without the surrounding quotes, so you can drop it straight between your own quotes in code or config. JSON and JavaScript share the same escape set here, so the same unescape recovers either one.

The five core characters &, <, >, double quote and single quote are converted to entities (&amp;, &lt;, &gt;, &quot; and &#39;) so the text is safe inside HTML, and unescape converts them, plus &apos;, back to the original characters.

It uses encodeURIComponent, which is meant for a single component such as a query value. It percent encodes reserved characters like &, = and spaces but leaves letters, digits and a few marks like - _ . ! ~ * ' ( ) alone, so do not run a full URL through it or the slashes and colon will be encoded.

It wraps the whole value in single quotes and rewrites any embedded single quote as the sequence '\'' so the argument is safe to paste into a POSIX shell like bash, sh or zsh. It is not designed for Windows cmd or PowerShell, which quote arguments differently.

It backslash-escapes the characters that are special in a JavaScript regular expression: . * + ? ^ $ { } ( ) | [ ] the backslash, the forward slash and the hyphen. After escaping, the text matches literally instead of being interpreted as a pattern.

Shell quoting and regex escaping are not losslessly reversible from the output alone, so the Unescape option is disabled for them and offered only for JSON, JavaScript, HTML and URL, where the original string can be reconstructed exactly.

No. All escaping and unescaping happens locally in your browser, so your strings never leave your device.