Escape converter

Escape and unescape HTML, JS and JSON strings.

Type

You need to drop a snippet of text into an HTML page, a JavaScript literal or a JSON payload, and it contains exactly the characters that will break the surrounding syntax — an angle bracket, a stray quote, a line break.

This converter handles the three cases in both directions. Choose the target format, paste the text, and press Escape or Unescape.

How it works

The three types

HTML entities. Escaping replaces &, <, >, " and ' with &, <, >, " and '. Unescaping is broader — it decodes named and numeric entities generally, so   and € resolve as well.

JS string. Escaping backslash-prefixes \, ', " and the backtick, and turns real line breaks and tabs into \n, \r and \t. Unescaping reverses those. Use this when pasting text into a quoted literal in a .js file.

JSON string. Escaping produces a complete JSON string value, including the surrounding double quotes — hello "you" becomes "hello \"you\"". Unescaping expects that same complete form, quotes and all, and returns the raw text.

Escape or unescape?

You have	You want	Direction
Plain text with `<` and `&`	Safe HTML source	HTML → Escape
`<p>` in a log or export	Readable text	HTML → Unescape
A multi-line paragraph	One JS literal on one line	JS → Escape
A JSON value copied from a response	The underlying text	JSON → Unescape

A caution worth reading

Escaping for one context does not make text safe in another. HTML entity escaping protects an HTML text node, but it is not sufficient inside an attribute without quotes, inside a <script> block, or in a URL — each of those needs its own encoding. In particular, JS-string escaping is a formatting convenience, not a defence against injection; for user-supplied content in a real application, use your framework's context-aware output encoding rather than pasting pre-escaped strings into templates.

Terms explained

HTML entity: A `&name;` or `&#number;` sequence that stands in for a character, letting text like `<div>` appear on a page instead of being read as markup.
Escape: Adding the markers a format requires so that special characters are treated as ordinary text rather than as syntax.
Unescape: The reverse — turning those markers back into the characters they represent.
JS string literal: Text written between quotes in JavaScript source. Line breaks are not allowed inside plain quotes, which is why they become `\n`.
JSON string: A JSON value made of double quotes wrapping escaped text. The quotes are part of the value, not decoration.

Frequently asked questions

Why does the JSON result have quotes around it?

Because a JSON string value includes its own double quotes — that is what makes it valid JSON. If you only want the escaped characters, delete the first and last character of the result before pasting it into a larger structure.

Why does JSON unescape fail on my input?

Unescaping parses the input as a complete JSON string, so it needs the surrounding double quotes. Text like `hello \"you\"` will be rejected, while `"hello \"you\""` works. Add the outer quotes and try again.

What is the difference between the JS and JSON options?

JSON escaping always produces a double-quoted value and follows the JSON specification exactly. JS escaping is looser: it escapes single quotes and backticks too, so the result can be dropped into any of the three JavaScript quote styles.

Is escaping here enough to prevent XSS?

No, and it should not be relied on for that. This is a formatting tool for text you control. User-supplied content in a live application needs encoding applied by the templating layer at the point of output, matched to the exact context — HTML body, attribute, script, or URL.

Does my text get sent to a server?

No. Both directions are handled in your browser with JavaScript, so pasted text stays on your device.