Escape text for a JSON, JavaScript, Java, Python, SQL or CSV string, or unescape it
Runs in your browser. Nothing you type is sent anywhere. Checked against sources on 16 Oct 2026.Escaping a string writes the characters a language reserves as safe sequences. In JSON, a double quote becomes \", a backslash \\ and a line break \n; any control character below U+0020 must be escaped. SQL instead doubles a single quote, and CSV doubles a double quote. This tool covers 6 languages both ways.
Paste the text into the Input pane, or click Try an example.
Choose the language: JSON, JavaScript, Java, Python, SQL or CSV.
Pick the quote style if the language has more than one, and turn on Add quotes to get a whole literal.
Click Copy, or press Ctrl+Enter, and paste the result into your code.
Every language that puts text between quotes needs a way to include the quote itself, the backslash and characters you cannot type, such as a line break. That is escaping. The rules differ slightly per language, and a string escaped for one can be wrong in another, so pick the language first.
| Language | Quote inside | Line break | Other |
|---|---|---|---|
| JSON | \" |
\n |
controls as \u001f; \x is not allowed |
| JavaScript | the chosen quote, backslashed | \n (real in backticks) |
\x1F, \u{1F44B}, ${ escaped in templates |
| Java | \" |
\n |
\u0001, octal \101 |
| Python | the chosen quote, backslashed | \n |
\x07, ₹, \U0001f44b |
| SQL | '' (doubled) |
as is | backslash is not special in standard SQL |
| CSV | "" (doubled), field in quotes |
inside quotes | quotes added only when needed |
Escape. Paste text and the escaped version appears as you type. JSON output matches what JSON.stringify writes, character for character. Turn on ASCII only to write accents and emoji as escape codes too, for systems that cannot carry UTF-8. Add quotes wraps the result so it is a complete literal.
Unescape. Paste the inside of a string, or the whole literal with its quotes, and get the text back. Each language's own rules apply: JSON refuses \x41, JavaScript refuses old octal escapes as strict mode does, Python keeps unknown escapes such as \d as written, and Java accepts \uuuu0041. The first invalid sequence is reported with its position.
The escaping is checked against the JavaScript engine itself for JSON and JavaScript, and against CPython for Python.
Everything runs in your browser; nothing you paste is sent anywhere.
Put a backslash before each double quote inside a JSON string, so He said "hi" is written as "He said \"hi\"". The backslash itself must also be doubled, as \\. Single quotes need no escaping in JSON, because JSON strings are always wrapped in double quotes.
Write \n where the line should break. JSON does not allow a raw line break inside a string, so a multi-line text must have every line break, and every tab, escaped as \n and \t. A Windows line ending becomes \r\n. Pasting a multi-line text here produces exactly that.
Double the single quote: O'Brien is written 'O''Brien' inside an SQL string. Standard SQL, PostgreSQL, SQL Server, Oracle and SQLite all follow this rule. MySQL also accepts a backslash before the quote, but doubling works there too, so doubling is the safe choice for every database.
Backslashes everywhere usually mean the JSON was stored as a string inside other JSON, so its quotes became \" and its line breaks \n. Unescape it once with the JSON setting and you get the inner JSON back; if it still shows backslashes, it was escaped twice and needs a second pass.
Escaping marks special characters inside one format so they are read literally, such as \" inside a JSON string. Encoding rewrites the whole text into another form, such as Base64 or percent-encoding for URLs. An escaped string is still readable; an encoded one usually is not. Use the URL Encoder or Base64 tool for those jobs.
No. Escaping by hand is easy to get wrong across databases and character sets, and one missed quote is enough for an injection. Use parameterised queries or prepared statements in application code, where the database receives the value separately from the SQL. Manual escaping is for one-off scripts, migrations and data fixes.
Rates and rules change; check the source before you rely on a figure.
Still stuck? Ask about String Escape & Unescape and anybody who knows can answer. No account needed.
Same job, other tools: Query String Parser – Split a URL query string into a table of decoded parameters · TSV to JSON – Convert tab-separated values, such as a paste from Excel, into JSON · JSON to YAML – Turn JSON into clean, readable YAML for configs.
Open it set for: JSON Unescape · JavaScript String Escape · SQL String Escape.