Escaping a string for the target that will read it
The same text needs different characters changed depending on whether it lands in JSON, a CSV cell or an HTML page. Pick a target and a direction, paste the string, and you get the result for that target alone, its length, and the rules that applied to this particular conversion.
JSON changes double quotes, backslashes and control characters, and allows neither \x nor \v. JS adds the line separators U+2028 and U+2029 on top of that. CSV wraps a field in quotes only when it holds a comma, a quote or a newline, and doubles any quote inside. HTML swaps five characters for entities, and URLs keep separate rules for one component and for a whole address.
Unescaping reads it all back. When the input does not match the rules, as with broken percent encoding or an escape JSON never had, the tool points at the problem instead of guessing. As of October 2026 this page handles ordinary strings only; regular-expression metacharacters and shell quoting are out of scope.
Frequently Asked Questions
JS accepts \x, \v, \0 and an escaped single quote, while JSON accepts none of them. Conversely the line separators U+2028 and U+2029 are legal raw in JSON but safer escaped inside a JS literal.
Use the component rule for a single key or value, because it also encodes slashes and question marks. Use the whole-URL rule to tidy a finished address; separators survive, so an & inside a value is not protected.
These five replacements cover text and attribute positions, but inside a script block or a URL attribute the rules differ and this is not enough. Apply the rule that matches the slot the value lands in.