JSON Escape/Unescape

The JSON Escape/Unescape tool specifically handles the unique case of JSON-within-JSON or JSON-in-string embedding. When you need to include a JSON document as a string value inside code (JavaScript, SQL, HTML, Java, config files), every quote and backslash must be escaped. Conversely, JSON strings retrieved from databases or nested API responses come escaped — unescape them back to readable JSON. This is different from general String Escape/Unescape (which handles various formats) or URL Encoder/Decoder (URL-specific). This tool focuses specifically on JSON: properly escape inner quotes, backslashes, newlines, and control characters, or reverse the process.

Common scenarios: logging JSON payloads to a text log (need escaping), storing JSON as a string in a database TEXT column (escape it), JWT tokens containing JSON claims (already escaped, need to unescape to read), and embedded JSON in source code (hardcoded JSON strings need escaping). Runs in your browser — your JSON (maybe with secrets) never leaves.

JSON escape rules (RFC 8259 §7):

Characters that must be escaped in JSON string values:

| Character | Escape | Unicode |
|---|---|---|
| Double quote | \\" | U+0022 |
| Backslash | \\\\ | U+005C |
| Forward slash | \\/ (optional) | U+002F |
| Backspace | \\b | U+0008 |
| Form feed | \\f | U+000C |
| Newline | \\n | U+000A |
| Carriage return | \\r | U+000D |
| Tab | \\t | U+0009 |
| Control chars U+0000 to U+001F | \\uXXXX | |

JSON-in-JSON:

When one JSON contains another as a string:

Inner JSON:
``json
{"name": "Alice", "age": 30}
``

Escaped for embedding:
``
{\"name\": \"Alice\", \"age\": 30}
``

Outer JSON containing escaped inner:
``json
{
"payload": "{\"name\": \"Alice\", \"age\": 30}",
"signature": "..."
}
``

When parsing payload, JSON.parse gives you the string {"name": "Alice", "age": 30}. Parse THAT with JSON.parse to get the object. Double-parsing.

Common sources of escaped JSON:

JWT payload (Base64URL encoded JSON):
``
eyJuYW1lIjoiQWxpY2UiLCJhZ2UiOjMwfQ
`
Base64-decode to get {"name":"Alice","age":30}` — that is JSON, not escaped string.

Log files with JSON as message:
``
2026-05-05 ERROR [worker-1]: Payload received: {\\"id\\":42,\\"error\\":\\"timeout\\"}
``
Log escapes JSON to fit on one line. Unescape to read.

Database-stored JSON in TEXT column:
``sql
INSERT INTO logs (payload) VALUES ('{"user":"Alice"}')
``
If stored in TEXT (not JSONB), may be escaped when retrieved via some drivers.

Webhook payload in URL parameter:
``
?payload=%7B%22user%22%3A%22Alice%22%7D
``
URL-encoded (not JSON-escaped — different). Use URL Encoder/Decoder for URL.

Escape in programming languages:

JavaScript:
``javascript
const jsonString = JSON.stringify(obj); // Produces JSON text
const escaped = JSON.stringify(jsonString); // Escapes for embedding
``

Python:
``python
import json
json_str = json.dumps(obj)
escaped = json.dumps(json_str) # Double encode
``

Java:
``java
ObjectMapper mapper = new ObjectMapper();
String jsonStr = mapper.writeValueAsString(obj);
String escaped = mapper.writeValueAsString(jsonStr);
``

Common pitfalls:

- Triple-encoded JSON: accidentally escaped multiple times. Each layer adds backslashes. Unescape repeatedly to reveal original.
- Mixed escape rules: JSON escape vs URL encode vs shell escape. Use the right one.
- Control characters in source: real newlines in JSON source must be \\n (escaped). Paste with real newlines fails.

Validation:

Escape: always works on any string.
Unescape: requires valid JSON-escape syntax. Reports errors like unknown escape sequences or unterminated strings.

When to use this tool vs others:

- JSON in a JSON value: this tool.
- HTML entity encoding: HTML Entity Encoder/Decoder.
- URL encoding: URL Encoder/Decoder.
- Base64 (for binary in JSON): Base64 Encoder.
- Multi-format string escape: String Escape/Unescape.

JSON Escape vs String Escape: This tool specifically for JSON within JSON/string. General String Escape/Unescape handles multiple formats (HTML, JS, SQL, etc.).

JSON Escape vs URL Encoding: Different purposes. JSON escape for string contents inside JSON. URL encoding for putting data in URLs (%20 for space). Use correct one for your context.

JSON Escape vs Base64: Base64 for binary-to-text (images, files in JSON). JSON escape for text-in-JSON. Different purposes; often combined (binary → Base64 string → escape as JSON value).

JSON Escape vs JSON Minification: Minification removes whitespace from JSON. Escape prepares JSON for embedding as string. Different operations; JSON can be both minified AND escaped (minify first, then escape).

Double-escaped issue: Common mistake — escape, then escape again accidentally. Each escape doubles backslashes. Unescape repeatedly to fix.

JSON.stringify twice vs JSON.stringify once: In JavaScript, JSON.stringify(obj) produces JSON. JSON.stringify(JSON.stringify(obj)) produces JSON string of that JSON — escaped string. Rarely what you want.