String Escape / Unescape

Escape or unescape strings for JavaScript, JSON, HTML entities, URL percent-encoding, SQL string literals, and CSV cells, then export a privacy-safe string escape QA pack with context risk notes, derived character inventory, and a starter Node assertion test. The pack intentionally omits raw pasted strings and converted output.

Runs in your browser Nothing uploaded Free, no signup

Everything stays in this browser

String Escape / Unescape: questions

What is in the string escape QA pack?
It summarizes the selected mode and format, character counts, newline/tab/quote/backslash/entity-risk inventory, context notes, and a starter Node assertion test without copying the raw input or converted output.
What is the difference between JS and JSON escaping?
Both escape the same special characters, but JSON additionally requires Unicode-safe string literal behavior and does not allow single-quoted strings.
Is URL encoding the same as HTML encoding?
No — URL encoding converts characters to %XX hex sequences, while HTML encoding converts characters to named or numeric entities. Use URL encoding in query strings; HTML encoding in HTML attribute values and text content.
Does SQL escaping prevent injection?
Basic SQL string escaping (doubling single quotes) is a fallback — always use parameterized queries in production. This tool is for understanding the escape form and reviewing context boundaries, not as a security guarantee.

Made something with AI? Share it as a private link.

Drop in the HTML from Claude, ChatGPT or any editor and get a link your client can open anywhere — with a password, view tracking, comments and approval.