JSON String Escape and Unescape Online

What this tool does

This tool escapes text so it can sit safely inside a JSON string, and unescapes a JSON string back into plain text. It follows section 7 of RFC 8259, the JSON specification, and it runs entirely in your browser.

When you need it

• Putting a multi-line message, a file path or a snippet of code into a JSON payload by hand, for a curl body, a config file or a test fixture.
• Reading a string copied out of a JSON log or API response that is full of \n, \" and é.
• Embedding JSON inside a string in another language, where you need the escaped form of a JSON string itself.
• Finding out why a hand-built JSON document is rejected as invalid.

What the RFC requires

Section 7 says a JSON string may contain any Unicode character except those that must be escaped: the quotation mark ", the reverse solidus \, and the control characters U+0000 through U+001F. That is the full list. Everything else, including the forward slash, accented letters and emoji, may appear as itself in a UTF-8 document.

The RFC provides short escapes for five of the controls (\b, \f, \n, \r, \t) and the six-character \uXXXX form for all others, so a bell character is \u0007. Hex digits can be either case; this tool writes lowercase, the same as Python's json.dumps. A character above U+FFFF, such as 😀, is written in \u form as a UTF-16 surrogate pair: 😀.

The options

Escape non-ASCII as \uXXXX rewrites every character outside printable ASCII (U+0020 to U+007E) as \u escapes. You only need this when the destination cannot be trusted with UTF-8, such as an ASCII-only log pipeline or a legacy system. Note that DEL (U+007F), which the RFC does not require escaping, is escaped in this mode, matching json.dumps(..., ensure_ascii=True). The output was compared with Python's json.dumps across a test set with quotes, backslashes, all control characters, DEL, U+2028, accented letters, CJK and emoji, and matched character for character, including after a round trip through json.loads.

Escape forward slash writes / as \/. The two forms mean the same thing, and the escape is optional. People use it when embedding JSON in an HTML script block so that </script> cannot end the block early. It is off by default so URLs stay readable.

Include surrounding quotes wraps the escaped value in double quotes, giving you a complete JSON string literal rather than just its content.

Unescaping, and why it can fail

Unescape mode accepts either the bare content or a full quoted literal, and reverses every legal escape. It is strict, as a real parser is, and tells you the position of the problem:

• an unescaped " inside the text;
• a raw newline, tab or other control character (JSON does not allow them unescaped);
• a backslash followed by anything other than " \ / b f n r t or u plus exactly four hex digits. Sequences such as \x41 or \', which are valid in JavaScript or Python string literals, are not valid JSON.

If your text came from a source code literal rather than JSON, it may legitimately contain escapes JSON does not support. Unpaired surrogates, such as a lone \ud800, are legal JSON syntax and are decoded as they are.

Round trips

Escaping then unescaping returns your original text exactly, in all option combinations, because escaping is a one-to-one mapping and unescape accepts everything the escaper can write. The reverse is not guaranteed: unescape then escape can change text, since é and é are two spellings of the same character and \/ and / are two of the same slash.

Limits

Input is capped at 200,000 characters. Lengths shown are in UTF-16 code units, which is how JavaScript counts string length, so an emoji counts as 2.