String Escaper
Escape — or unescape — any string for a target syntax: JSON, JavaScript, HTML, URL, shell, SQL, or regex. Spec-aware. Runs in your browser; nothing is uploaded.
About this tool
String Escaper makes a string safe to drop into a chosen syntax — and, where the escaping is reversible, turns it back into raw text.
Pick a target:
- JSON — escapes quotes, backslashes, newlines, tabs and control characters
(
\uXXXX) for a JSON string body. Tick Wrap in quotes to add the"…". - JavaScript — a JS string literal, also escaping
',`and the line-separator code points U+2028 / U+2029 that break JS strings. - HTML — replaces
&,<,>,"and'with HTML/XML entities. - URL — percent-encodes a component (everything outside
A–Z a–z 0–9 - _ . ~). - Shell — wraps the text as a single safe POSIX single-quoted argument.
- SQL — doubles single quotes for a SQL string literal.
- Regex — backslash-escapes regex metacharacters so the text matches literally.
Unescape reverses the JSON, JavaScript, HTML and URL escapings. Shell, SQL and regex escaping are one-way (un-escaping them is ambiguous).
Everything runs locally in your browser via WebAssembly — nothing is uploaded.
Handy for
- Pasting a snippet safely into a JSON or HTML config or an API payload.
- Building a shell command or SQL query with untrusted text.
- Turning a fixed string into a literal regex pattern.
FAQ
Why is unescape unavailable for shell, SQL and regex?
Those escapings aren't uniquely reversible: given '' in SQL you can't tell
whether the original was a quote or two adjacent strings, and a shell-quoted
or regex-escaped string has several raw forms that produce identical output.
Unescape therefore works only for JSON, JavaScript, HTML and URL, where a
strict inverse exists — the other three return an explicit error.
What does the "Wrap in quotes" checkbox actually change?
It adds the outer delimiters for targets that have them: "…" for JSON and
JavaScript, '…' for SQL. HTML, URL and regex have no quoting concept, and
the shell target always produces one safe POSIX single-quoted argument
regardless of the checkbox.
Should I URL-escape a whole address or just a piece of it?
Just the piece. The URL target does strict component encoding — every
byte outside A–Z a–z 0–9 - _ . ~ is percent-encoded, including /, :
and ?. Escape a query value or path segment and splice it into the URL;
escaping a complete URL would mangle its structure.
Is SQL escaping here enough to stop injection?
It applies the standard rule — doubling single quotes inside a string literal — which is correct for a well-formed literal. But for untrusted input in production code, parameterized queries remain the right tool; string escaping is best for one-off queries and generated fixtures.
Developer & Automation Access
Run it from the terminal
Same engine as this page, headless — via the gizza CLI:
gizza tool string-escaper 'He said "hi"
Line two' 'target=json'New to the CLI? Get gizza →
Open it by URL
Pre-fill and auto-run this tool with query parameters — the names match the API/CLI:
https://gizza.ai/tools/string-escaper/?text=He%20said%20%22hi%22%0ALine%20two&target=json&mode=escape"es=trueMachine-readable descriptor: tool.json — title + parameters JSON Schema for agents.