🔒 Runs in your browser — nothing is uploaded✓ Free, no signup
String Escape & Unescape
Escape or unescape text for nine languages and formats — JavaScript, Java, C#, JSON, HTML, XML, SQL, CSV and regex — so quotes, backslashes and special characters are safe to paste into code.
0 characters
Escaped string
When should you use the String Escape / Unescape?
- Pasting text with quotes or Windows paths into a string literal
- Escaping user text for a SQL statement or CSV cell
- Matching a literal string with a regular expression
How to use the String Escape / Unescape
- 1
Pick the language
Choose where the string will be used — JavaScript, Java, C#, JSON, HTML, XML, SQL, CSV or Regex.
- 2
Escape or unescape
Escape makes text safe for that language. Unescape reverses it.
- 3
Paste your text
The result updates as you type.
- 4
Copy
Copy the result into your code.
Examples
Same text, different languages
Text
It's "done" — C:\temp
Escaped
JavaScript It\'s \"done\" — C:\\temp SQL It''s "done" — C:\temp Regex It's "done" — C:\\temp
Common errors and how to fix them
SQL injection worries- Escaping helps, but always use parameterised queries or prepared statements in real applications instead of building SQL strings by hand.
Unescape changed nothing- Make sure the language matches how the text was escaped — SQL uses doubled quotes ('') while JavaScript uses backslashes.
More from Encoding & Security
Free tools that run in your browser — no signup, nothing uploaded.
JWT Decoder
Decode and inspect JSON Web Tokens (JWT) Header and Payload.
JWT Generator
Create and sign HS256/HS384/HS512 JSON Web Tokens for testing.
Hash Generator (MD5, SHA)
Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes.
Password Generator
Generate strong, random passwords with the length and characters you choose.
Base64 Encoder ⇆ Decoder
Encode text to Base64 and decode Base64 to text for API debugging.
URL Encoder & Decoder
Cleanly encode special characters in URLs and decode query strings.
HTML Entity Encoder & Decoder
Encode special characters as HTML entities, or decode entities back to text.
Number Base Converter
Convert numbers between binary, octal, decimal, hex and any base up to 36.
Text to Hex & Binary Converter
Convert text to hex, binary, ASCII codes or Unicode code points — and back.
String Escape / Unescape FAQ
Characters like quotes and backslashes have special meaning inside a string literal. Escaping marks them as plain characters so they don't end the string or start an escape sequence.
Standard SQL escapes a single quote by doubling it: O'Brien becomes O''Brien. Use prepared statements in application code — they handle this for you and prevent SQL injection.
Values that contain commas, quotes or line breaks are wrapped in double quotes, and any double quote inside is doubled — say "hi", ok becomes "say ""hi"", ok".
It puts a backslash before characters that have special meaning in regular expressions — like . * + ? ( ) [ ] { } | ^ $ — so the pattern matches them literally.
They're very similar. JavaScript also escapes backticks (for template literals) and supports \x and \u{…} escapes; Java uses \uXXXX. Pick the language you're writing.
No. Escaping and unescaping happen in your browser.