Escape a string for JSON
Turn any text — including a whole JSON document — into a single escaped JSON string literal you can safely embed in another payload.
- Runs in your browser
- Nothing you enter is sent
- Free, no account
Your JSON never leaves this tab — check it yourself—
Starting the network probe…
The counter above wraps fetch, XMLHttpRequest and navigator.sendBeacon in this tab and counts every call. It does not block anything — it just reports.
Two ways to verify independently
- Turn off Wi-Fi or enable airplane mode, then use the tool. It keeps working, because the page is already fully loaded.
- Open your browser devtools, switch to the Network tab, clear it, and run the tool. No new row appears.
Why this matters
In 2025 researchers found that popular online formatters had retained tens of thousands of user-submitted snippets — JSONFormatter.org and CodeBeautify together exposed roughly 80,000 saved documents, many containing live cloud credentials, private keys and internal database connection strings, because “format this” quietly meant “upload this”. A separate incident exposed roughly 3.5 million user PDFs on a document-conversion service. The only structural fix is not sending the data in the first place: this site is served under a Content-Security-Policy whose connect-src contains no third-party origin, so a request off this device cannot be made even by accident.
What escaping for JSON means
A JSON string is delimited by double quotes, so any double quote inside it has to be marked as data rather than a delimiter. The same applies to the backslash that does the marking, and to the control characters that cannot appear literally. Escaping is the mechanical process of applying those rules to arbitrary text so the result is a single, valid JSON string.
The complete escape table
| Character | Escaped as | Required? |
|---|---|---|
Double quote " | \" | Always |
Backslash \ | \\ | Always |
| Backspace (U+0008) | \b | Always |
| Form feed (U+000C) | \f | Always |
| Line feed (U+000A) | \n | Always |
| Carriage return (U+000D) | \r | Always |
| Tab (U+0009) | \t | Always |
| Other control characters | \u00XX | Always |
Forward slash / | \/ | Optional — only needed to avoid </script> inside HTML |
| Any printable Unicode | Itself | Never — JSON is UTF-8 |
The nested-JSON case
The most common reason to be on this page is embedding one JSON document inside another. Webhook
payloads do it ({"event": "x", "payload": "{\"id\":1}"}), log
aggregators do it, and message queues that carry a typed envelope around an opaque body do it.
Paste the inner document here, keep the surrounding quotes, and drop the result straight into
the outer document as a value.
One warning: doing this twice produces \\" everywhere and is nearly always a bug
in a pipeline where two layers both escape. If the text you are looking at has more backslashes
than quotes, run unescape until it stops changing and then fix the
layer that is escaping unnecessarily.
Escaping is context-specific
Three escaping schemes get confused constantly because all three make text “safe” and none of them makes it safe for the other two contexts.
- JSON uses backslashes and applies inside a JSON string.
- URL encoding uses
%XXand applies inside a URL — see the URL encoder. - HTML escaping uses
&entity;and applies inside markup — see the HTML entity encoder.
Text that goes through two contexts needs both, applied in the right order. JSON embedded in an HTML attribute is escaped for JSON first, then for HTML.
Should the quotes be included?
Keep them when you are pasting the result as a complete JSON value. Turn them off when the destination already has quotes around it — for instance when you are typing between the quotes of an existing string in your editor.
Questions
When do I need to escape JSON?
Whenever a JSON value has to contain text that itself contains quotes, backslashes or newlines. The two most common cases are embedding a JSON document inside another JSON document — webhook payloads and log fields do this constantly — and putting a multi-line template into a single string field.
Which characters get escaped?
Double quote and backslash always; the control characters backspace, form feed, newline, carriage return and tab become their two-character escapes; everything else below U+0020 becomes a \u escape. Printable Unicode above ASCII is left as-is, because JSON is UTF-8.
Should I keep the surrounding quotes?
Keep them if you are pasting the result as a complete JSON value. Turn them off if you are pasting into somewhere that already has quotes around it, such as between the quotes of an existing string in a code editor.
Is this the same as URL encoding or HTML escaping?
No — three different escaping rules for three different contexts. JSON escaping uses backslashes, URL encoding uses %XX, and HTML escaping uses &entity;. Using the wrong one produces text that looks escaped but is not safe.