String Escape / Unescape

Escaping turns special characters into a safe form: in HTML the less-than sign becomes <, in JSON a line break becomes \n, in a URL Cyrillic text becomes %D0%BA. Unescaping reverses the change. Pick the mode by where the text is going: markup, code, a URL, a table.

After every conversion the result is unescaped back and compared with the original character by character. If anything does not match, the page says so directly.

Modes

• HTML: five special characters; unescaping understands all named entities, including   and —;
• XML: only the five entities, no  ;
• JSON and JavaScript: string literal contents, quotes optional, non-ASCII optional as \u0430;
• CSV cell: quotes added when the text contains a delimiter, a quote, or a line break; a quote inside is doubled;
• SQL string: the apostrophe is doubled. This is not a replacement for query parameters: avoid putting values into query text at all;
• regular expression: dots, brackets, asterisks and other special characters get a backslash.

Your text stays in the browser

People escape tokens, passwords, and fragments of other people's emails. Nothing goes to a server: conversion and comparison run on your side.