Paste text to turn it into a correctly escaped string literal for JavaScript, JSON, Java, C#, Python, C, SQL, regular expressions, CSV or the shell, or paste an escaped string to get the raw text back. Each backslash sequence is listed with its meaning, and hidden whitespace is made visible.
Last updated:
Samples:
Escape sequences
Raw text, whitespace visible
· space → tab ↵ line feed ␍ carriage return ⍽ no-break space
Advertisement
Advertisement
How to use the String Escape / Unescape
Choose Escape or Unescape at the top.
Pick the target: JavaScript, JSON, Java, C#, Python, C/C++, SQL, regex, CSV or shell, and adjust its options such as quote style or dialect.
Type or paste the text or escaped string. The result updates instantly.
Review the escape sequence list and the visible whitespace preview to check exactly what the string contains.
Copy or download the result, or press Swap to convert it back the other way.
Escape sequences by language
Most languages share the C-style backslash escapes, but the details differ. ✓ means the escape is valid in that language's normal string literal.
Escape
Meaning
JS
JSON
Java
C#
Python
C/C++
\n \r \t
line feed, carriage return, tab
✓
✓
✓
✓
✓
✓
\b \f
backspace, form feed
✓
✓
✓
✓
✓
✓
\v
vertical tab
✓
-
-
✓
✓
✓
\a
bell
-
-
-
✓
✓
✓
\0
null character
✓
-
✓ (octal)
✓
✓ (octal)
✓ (octal)
\xHH
character by hex code
✓ (2 digits)
-
-
✓ (1-4 digits)
✓ (2 digits)
✓ (any length)
\uXXXX
UTF-16 code unit
✓
✓
✓
✓
✓
✓ (C11/C++11)
\u{1F600}
any code point
✓ (ES2015)
-
-
-
-
-
\U0001F600
any code point (8 digits)
-
-
-
✓
✓
✓
\/
slash
✓ (identity)
✓
-
-
-
-
Quoting rules outside C-style languages
Target
Rule
Example: it's "ok"
SQL (standard)
Double each single quote inside '…'
'it''s "ok"'
MySQL
'' or backslash escapes \' \" \\ \n \0 \Z
'it\'s \"ok\"'
CSV (RFC 4180)
Quote fields with commas, quotes or line breaks; double inner quotes
"it's ""ok"""
Shell, single quotes
Everything literal; a quote is written '\''
'it'\''s "ok"'
Shell, double quotes
Escape \ " $ and backtick with a backslash
"it's \"ok\""
C# verbatim
Only double quotes are doubled
@"it's ""ok"""
Regex
Backslash before . * + ? ^ $ { } ( ) | [ ] \ /
it's "ok" (nothing special)
Tips
Escaping is not a defence against injection by itself. For SQL use prepared statements, for shell commands pass arguments as an array (for example subprocess.run([...])) instead of building one command string.
Formulas in CSV files (cells starting with =, +, - or @) can run when opened in a spreadsheet. The "Neutralize formulas" option prefixes them with an apostrophe, as recommended by OWASP.
Use the visible whitespace panel to find invisible problems such as trailing spaces, Windows CRLF line endings (␍↵), no-break spaces and zero-width characters.
Frequently asked questions
What does escaping a string mean?
Escaping rewrites characters that have a special meaning inside a string literal so they are read as plain text. In most C-style languages a backslash starts an escape: \" is a double quote that does not end the string, \n is a line break and \\ is a single backslash. SQL doubles the quote instead ('' inside '...'), and CSV doubles double quotes inside a quoted field.
How do I escape a single quote in SQL?
Standard SQL, PostgreSQL, SQL Server, SQLite and Oracle double it: 'O''Brien'. MySQL and MariaDB also accept backslash escapes such as \' unless NO_BACKSLASH_ESCAPES is enabled. For queries built from user input, use parameterised queries (prepared statements) instead of escaping by hand, because they also protect against SQL injection.
What is the difference between JavaScript and JSON escaping?
JSON is stricter. It only allows \" \\ \/ \b \f \n \r \t and \uXXXX, requires double quotes, and forbids raw control characters. JavaScript also accepts single quotes and backticks, \v, \0, \xHH and \u{1F600}, and treats an unknown escape such as \q as just q. This tool reports escapes that are invalid in JSON.
How do I escape special characters in a regular expression?
Put a backslash before each of . * + ? ^ $ { } ( ) | [ ] and \, and also / if the pattern is written as a /…/ literal in JavaScript. The Regex target does exactly that, so the pattern matches the text literally. Hyphens are not escaped because \- outside a character class is an error in JavaScript's Unicode mode.
How do I escape a string for bash or another shell?
The safest way is single quotes: everything inside is literal, and a single quote itself is written as '\'' (end the quote, an escaped quote, start a new quote). Double quotes still expand $, ` and \, and ANSI-C quoting $'…' lets you write \n and \t. The Smart option leaves simple words unquoted and single-quotes everything else.
Why does Java not use \u000A for a newline in a string?
The Java compiler replaces \uXXXX escapes before it parses the code, so \u000A becomes a real line break in the middle of the string literal and the file no longer compiles. That is why this tool writes control characters in Java as \n, \t or octal escapes such as \0 and \033, and uses \u only for printable characters.
Is my text sent anywhere?
No. Escaping and unescaping are done in JavaScript on your device. Nothing is uploaded or stored, so it is safe for code, keys and private data.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.