ToolBench

Escape / Unescape

Escape text for safe use inside HTML/XML markup, a JavaScript or JSON string literal, or a regular expression pattern — or unescape text back to its raw form. Everything runs in your browser; nothing is uploaded.

0 chars0 lines0 bytes
0 chars0 lines0 bytes

What is Escape / Unescape?

Escape / Unescape is a browser-based tool that makes text safe to embed inside a specific context — HTML/XML markup, a JavaScript or JSON string literal, or a regular expression pattern — by replacing characters that would otherwise be interpreted specially. It also reverses the process, turning escaped text back into its raw form.

Every one of these contexts has characters with special meaning. In HTML, < starts a tag and & starts an entity; in a JavaScript or JSON string, " ends the string and \ starts an escape; in a regex, characters like ., *, and ( are operators. To include those characters as literal data, you must escape them, or the surrounding syntax breaks — often introducing bugs or security holes.

Choosing the right flavor matters because each escapes a different set of characters using different rules. This tool applies the correct escaping for the context you select, and unescapes it back just as precisely. Everything runs locally in your browser — nothing you paste is uploaded.

Why use Escape / Unescape?

Escaping correctly prevents both bugs and vulnerabilities. Embedding unescaped user text in HTML is the classic cause of cross-site scripting; embedding an unescaped quote in a JavaScript string breaks the code; forgetting to escape a dot in a regex silently matches any character. Getting the escaping right for the target context is essential, and doing it by hand is easy to botch.

The flavor selector removes guesswork. HTML escaping, JS/JSON string escaping, and regex escaping each protect a different set of characters, and using the wrong one leaves dangerous characters unescaped or over-escapes harmless ones. Picking the exact context gives you output that is correct for where the text will actually live.

Unescaping is just as useful for reading data. When you find escaped HTML entities in a log, a JSON string full of backslashes, or an escaped regex, pasting it here reveals the human-readable original. And because it all runs in the browser, sensitive text never leaves your machine — verifiable in the Network tab.

Features

  • Escape text for HTML/XML markup (entities like &lt; and &amp;)
  • Escape text for JavaScript or JSON string literals
  • Escape text for use inside a regular expression pattern
  • Unescape any of these formats back to raw text
  • Live conversion as you type
  • Clear errors for malformed escaped input when unescaping
  • One-click copy and download of the result
  • Runs entirely in your browser — no uploads, works offline

How to use Escape / Unescape

  1. Choose Escape to make text safe for a context, or Unescape to convert escaped text back to raw form.
  2. Select the format: HTML/XML, JavaScript/JSON string, or regular expression.
  3. Paste or type your text into the input panel on the left.
  4. The result appears in the right panel automatically as you type.
  5. Copy the result to your clipboard or download it as a text file.

Example 1 — Escape for HTML

Escape markup characters so the text renders literally instead of being parsed as tags.

Input

<b>hi</b>

Output

&lt;b&gt;hi&lt;/b&gt;

Example 2 — Escape for a regex pattern

Escape regex metacharacters so they match literally rather than acting as operators.

Input

a.b*c

Output

a\.b\*c

Common Mistakes

  • Using the wrong flavor for the context: HTML escaping does not make text safe inside a JavaScript string, and JS-string escaping does not protect HTML. Always match the flavor to where the text will actually be placed.
  • Assuming escaping is a security cure-all: correct escaping is the right defense against injection, but only when applied at the exact output context. Escaping for the wrong context can still leave you vulnerable.
  • Double-escaping: running already-escaped text through the escaper again turns &lt; into &amp;lt;, or \. into \\.. If output looks over-escaped, it was likely escaped twice — unescape once first.
  • Forgetting that HTML has multiple sensitive characters: escaping < but not & or quotes can still break markup or attributes. Rely on the tool to escape the full set rather than doing a partial manual replace.
  • Unescaping malformed input: an incomplete escape sequence, like a trailing backslash in a JS string or a broken entity, is not valid and will produce an error when unescaping. Ensure the input is complete.
  • Escaping the entire regex instead of just the literal part: if you escape a whole pattern, you turn your intended operators into literals too. Escape only the substrings that should be matched literally.

Developer Tips

  • Escape at the point of output, using the flavor for that exact context — HTML when injecting into markup, JS-string when building a script string, regex when inserting a literal into a pattern.
  • Use regex-escape to safely turn arbitrary user input into a literal match — this is the correct way to search for text that might contain regex metacharacters.
  • When you see mysterious &amp;lt; or double backslashes, you are looking at double-escaped data; unescape once to recover the intended single-escaped form.
  • For building JSON by hand, the JS/JSON string flavor escapes quotes and backslashes correctly so your string values stay valid.
  • Unescape HTML entities from a scraped page or log to read the real text before processing it further in your code.

Frequently Asked Questions

What is the difference between the HTML, JS/JSON, and regex flavors?
Each flavor escapes the characters that are special in its context. HTML/XML escaping converts characters like <, >, &, and quotes into entities (such as &lt;) so text renders literally instead of being parsed as markup. JS/JSON string escaping backslash-escapes quotes, backslashes, and control characters so the text is a valid string literal. Regex escaping backslash-escapes metacharacters like ., *, +, and ( so they match literally instead of acting as operators. Using the correct flavor is essential — each protects a different set of characters.
Does escaping protect me against injection attacks?
Correct escaping is the primary defense against injection attacks like cross-site scripting, but only when you apply the right flavor at the exact output context. Escaping user input for HTML before inserting it into a page prevents it from being interpreted as tags or scripts. However, escaping for the wrong context — for example HTML-escaping text that ends up inside a JavaScript string — can still leave you vulnerable. Always escape for the specific place the data will be rendered.
What is double-escaping and why is it a problem?
Double-escaping happens when already-escaped text is escaped a second time. In HTML, &lt; becomes &amp;lt; and then displays literally as "&lt;" instead of "<". In a JS string, \. becomes \\. which is not what you intended. It usually occurs when multiple layers of a system each escape the same value. To fix it, unescape the text once to recover the correctly single-escaped form, and ensure only one layer performs the escaping.
Why does unescaping sometimes produce an error?
Unescaping expects well-formed escaped input. A malformed sequence — such as a JavaScript string ending in a lone backslash, an incomplete Unicode escape, or a broken HTML entity — cannot be reversed cleanly, so the tool reports a clear error rather than guessing. This usually means the escaped text was truncated or corrupted when copied. Make sure you paste the complete, unmodified escaped string, and the unescape will succeed.
How do I safely include user input in a regular expression?
Use the regex flavor to escape the user input before inserting it into your pattern. This converts any regex metacharacters in the input — like ., *, or ( — into their literal, escaped forms, so the pattern matches the text exactly rather than interpreting those characters as operators. This is the standard, safe way to search for arbitrary text that might contain special characters, and it prevents both incorrect matches and potential regex injection issues.
Is my text uploaded anywhere?
No. All escaping and unescaping happens locally in your browser using JavaScript. Nothing you paste — which might include user data, code fragments, or scraped content — is sent to a server, logged, or stored. You can confirm this by opening your browser's Network tab while using the tool: there are zero outbound requests, and it continues to work even offline.