Free Online String Escaper
Escape and unescape HTML entities and JSON string characters. Switch between four modes: HTML encode, HTML decode, JSON escape, and JSON unescape.
Mode Reference
HTML Encode
Converts &, <, >, ", and ' to their HTML entity equivalents (& < > " '). Use before inserting user-supplied text into HTML to prevent XSS.
HTML Decode
Reverses HTML encoding. Converts entities like &, <, and " back to their literal characters.
JSON Escape
Escapes a string so it is safe to embed as a JSON string value: backslashes, double quotes, newlines, tabs, and control characters become \, \", \n, \t, etc.
JSON Unescape
Reverses JSON string escaping. Converts \n back to a real newline, \" back to a double quote, etc. Input should be the inner content of a JSON string (without the outer quotes).
Frequently Asked Questions
Whenever you're inserting user-supplied or dynamic text directly into HTML markup — a comment, a username, search results. Without encoding, characters like < and > can be interpreted as real HTML tags, which is the basis of cross-site scripting (XSS) attacks. Encoding neutralizes them into harmless entities.
They protect against different problems: HTML encoding escapes characters that HTML would otherwise interpret as markup (<, >, &, quotes). JSON escaping escapes characters that would break a JSON string literal (backslashes, double quotes, newlines, tabs) so the text can be safely embedded as a JSON value.
JSON string values can't contain a literal line break — the JSON spec requires control characters like newlines and tabs to be represented as escape sequences (\n, \t) instead, so the string stays on a single logical line within the JSON text.
No — paste just the inner content of the JSON string, without the surrounding double quotes. Including them will leave literal quote characters in your unescaped output.
It's completely free with no limits, and nothing is sent anywhere — escaping and unescaping happen entirely in your browser using JavaScript.