Skip to content
Go REST

URL, HTML, JS and JSON escape and unescape

Escape and unescape strings for the four formats you use most. Pick a target, choose escape or unescape, and the result updates as you type. Everything runs in your browser.

Four kinds of escaping, four different rules

"Escape" is one word for several transforms that do not mix. URL encoding swaps reserved characters for %XX hex sequences, so the string is safe in a URL. HTML escaping replaces characters that mean something in HTML markup with named or numeric entities (<, &). JS escaping adds backslash sequences, so the string can sit inside a JavaScript literal. JSON escaping is the stricter subset that always parses with JSON.parse.

Pick the right one. The wrong one changes your data without any error, or opens an injection bug.

When to use this tool

  • Debugging a broken URL. If your API call returns 400, look at the raw query string. Spaces may show up as + or %20, or special characters may be encoded wrongly. This tool shows both sides.
  • Reading entity-encoded HTML. Email previews, RSS feeds and old database fields often come as <p>Hello</p>. Unescape it to get the original markup back.
  • Making a JS string literal. Copying a block of text with many lines into a source file? Escape it as JS to get one safe quoted literal.
  • Writing a JSON test fixture. If your test data has quotes and new lines, JSON-escape it once, then paste it into a "key": "..." pair.

How each form works

  • URL encoding (percent-encoding, RFC 3986). Any byte outside the "unreserved" set (A-Z a-z 0-9 - _ . ~) becomes % and two hex digits of its UTF-8 bytes. encodeURIComponent is the JavaScript standard.
  • HTML entity encoding. The five characters that can change HTML parsing (&, <, >, ", ') are replaced with entities. The decoder also knows &hellip; and the whole entity table.
  • JS string escape. Special characters become backslash sequences: \n, \r, \t, \\, \". Code points above ASCII use \uXXXX, and those above FFFF use \u{...} (ES2015 and later).
  • JSON string escape. A stricter subset of the JS rules. \x and \u{...} are not allowed, and characters above FFFF need surrogate pairs. Always parses with JSON.parse.

Worked examples

  • URL: name=Tenali Ramakrishna&q=fake/data? escapes to name%3DTenali%20Ramakrishna%26q%3Dfake%2Fdata%3F.
  • HTML: <script>alert("ok")</script> escapes to &lt;script&gt;alert(&quot;ok&quot;)&lt;/script&gt;.
  • JS string: the rocket emoji 🚀 escapes to \u{1f680}, and a new line to \n.
  • JSON string: He said "hello" escapes to He said \"hello\".

Common mistakes

  • "It worked locally, broke in production". The client encoded the URL once, then a proxy or middleware encoded it again. %20 becomes %2520. Unescape twice to get it back.
  • Using JS escape inside JSON. \x20 and \u{1f600} are JS only. JSON.parse throws on them. Pick JSON escape when JSON is the target.
  • HTML-escaping URLs. An HTML-escaped URL in href works, because the browser decodes entities. But it is not URL encoding. &amp; in a query string still gives an ampersand, while a percent-encoded space (%20) does not show as a space.
  • Stripping instead of escaping. Removing < and > "to stop XSS" loses the user's content. Escape on output and let the browser show the characters. Never strip on input.

FAQ

What is the difference between URL encoding and HTML escaping?

URL encoding (percent-encoding) makes a string safe inside a URL. HTML escaping (entity encoding) makes a string safe inside HTML markup. They give different output and you cannot use one for the other.

When do I need a JavaScript string escape and when a JSON string escape?

They are almost the same, but JS allows the \x and \u{...} forms and JSON does not. JSON is the safer subset. Use it when you are not sure.

Does encodeURIComponent encode the slash?

Yes. URI components can hold slashes, so encodeURIComponent percent-encodes them. Use encodeURI (not on this page) if you need to keep the slashes.

Why does my HTML unescape drop the tags?

The decoder uses DOMParser, so real HTML tags in the input are read as markup and only their text comes back. Pass entity-encoded text (&lt;tag&gt;) to get the angle brackets back.

Is this tool safe against XSS in production?

The output is for checking, not for putting into production HTML. Use your framework's own escapers (Rails sanitize, Django autoescape, React JSX) for runtime output.