JSON Escape / Unescape

Embedding one piece of JSON inside another — or stuffing a multi-line string into a single JSON value — breaks the moment a quote or newline is taken literally. JSON Escape converts a raw string into its safely escaped form, and reverses the process when you need the original back.

Developers hit this whenever a string has to travel through a JSON field that is itself a string: storing a JSON snippet as a value, pasting a code block into a config, or preparing a multi-line message for an API. Escape mode turns the dangerous characters into their backslash equivalents; unescape mode restores them so you can read the content as it was written.

This converts a block of text into the escaped form needed to sit inside a JSON string, and reverses the process. Backslashes are doubled first — order matters, since escaping them after the other substitutions would double the escapes already inserted — then quotes, newlines, carriage returns, tabs, form feeds, and backspaces are replaced with their two-character sequences.

The distinction between this and formatting is worth being clear about. A formatter operates on a JSON document; this operates on the contents of a single string within one. It is what you need when embedding a code snippet, a log excerpt, an HTML fragment, or another JSON document inside a JSON string value.

Unescaping performs the reverse, turning the sequences back into the characters they denote, which is how you recover readable text from a value that has been escaped one or more times.

The specification requires escaping for exactly three things: the double quote, the backslash, and control characters below U+0020. Everything else is optional. The forward slash may be escaped and usually is not, though escaping it is a common defensive habit when embedding JSON inside a script tag, where the sequence that closes the tag would otherwise terminate it early.

Unicode above the control range can be sent literally in UTF-8 or escaped as a four-hex-digit sequence, and both are valid. Characters outside the basic multilingual plane — many emoji among them — require a surrogate pair of two such sequences, which is why an emoji sometimes appears as two escapes rather than one.

The practical hazard is double-escaping. Each round of embedding doubles the backslashes, so a value escaped twice contains four backslashes where the original had one, and unescaping the wrong number of times leaves data subtly corrupted. Where a payload has to travel through several layers, escaping once and encoding the result in base64 is usually more robust than nesting escapes.